How would you add role-based access control (admin, editor, viewer) to an existing full-stack app?

What the interviewer wants to hear

• Model roles and permissions in the database, scoped per organisation if needed
• Enforce permissions on the server for every request and action
• Centralize checks in one helper or policy layer
• Use the UI only to hide or disable actions, never as the security boundary
• Check ownership of specific records, not just the role
• Test permissions and audit sensitive actions

Model answer

I start with the data model: users have memberships in an organisation, each with a role, and roles map to permissions such as project:edit or billing:manage. Checking permissions rather than role names makes it easier to add roles later. On the server I write one central helper, like can(user, "project:edit", project), and call it in every route handler and server action, because the server is the only real boundary. The check covers both the permission and the specific record, so an editor in one organisation cannot edit another organisation’s project by changing an ID. Database queries are also scoped by organisation ID. In the UI I use the same permission data to hide or disable buttons, purely for user experience. I add tests for each role on sensitive endpoints, follow least privilege for new roles, and keep an audit log of admin actions.

More medium Full Stack Developer questions

• How would you implement login for a web app? Compare server sessions with JWT access tokens and explain what you would choose.
• Users say the orders page is slow. How do you find and fix the problem across frontend, API and database?
• How would you build a feature that lets users upload profile photos and PDF documents up to 100 MB?
• Your API is used by a web app and an older mobile app that users do not update quickly. How do you make a breaking change safely?
• Describe a good CI/CD pipeline for a full stack app. What runs on each pull request and how do you deploy safely?
• You need to build a product search page with text search, filters and sorting. Walk through the design from the UI to the database.
• What is your testing strategy for a full-stack feature such as "invite a teammate by email"?
• Describe the different layers where you can cache in a typical full-stack web app, and how you keep cached data correct.
• You need to show in-app notifications in real time. How do you choose between polling, server-sent events and WebSockets, and how would you build it?