What is a common mistake when working with role-based authorization?

A common mistake with role-based authorization is hard-coding role-name checks throughout application code makes authorization difficult to review and change consistently. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.