How should role-based authorization be designed for production?

For production, define roles around business capabilities, keep role assignment controlled and auditable, avoid excessive role proliferation, and combine roles with resource ownership checks when a role alone is insufficient. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.