How would you answer an interview scenario involving role-based authorization?

In an interview, I would first define role-based authorization and the problem it solves, then explain how I would define roles around business capabilities, keep role assignment controlled and auditable, avoid excessive role proliferation, and combine roles with resource ownership checks when a role alone is insufficient. I would also call out the main failure mode: hard-coding role-name checks throughout application code makes authorization difficult to review and change consistently. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.