Good question, as a beginner I'm wondering that as well. Roles seem to be only usable for small projects, otherwise you can get checks like (user.hasRole("foo") || user.hasRole("bar") || user.hasRole("YetAnotherRole") || ...).

Permission/activity based authorization (flat RBAC) seems to be more flexible: users are assigned roles, and permissions are assigned to roles. The checks within the application are against the permission not the role, and can be changed without recompiling the application. If a role needs new permissions just assign them in the backend, if a specific user needs new permissions it's possible to create a new role with appropriate permissions etc.

But what's with more complex permissions: * Superadmin can delete everyone except himself. * Admins can delete all users but not themself or other admins. * Manager can only delete users that he manages but not himself.

And then there is the "problem" of what is actually authorization, and what is actually a business rule or validation rule. Sometimes the line between authorization and business rules seems blurred.