RBAC Matrix Builder

# RBAC Matrix

| Resource | Admin | Editor | Viewer | Guest |
|---|---|---|---|---|
| Users | CRUD | RU | R | — |
| Posts | CRUD | RU | R | — |
| Comments | CRUD | RU | R | — |
| Settings | CRUD | RU | R | — |
| Analytics | CRUD | RU | R | — |

**Legend:** C=Create R=Read U=Update D=Delete CRUD=All — = No Access

## Implementation Notes
- Enforce at both API and UI layer
- Never rely on frontend-only permission checks
- Log all permission denials

## Code Pattern (Next.js)
```ts
export async function checkPermission(userId: string, resource: string, action: string) {
  const role = await getUserRole(userId);
  return RBAC_MATRIX[role]?.[resource]?.includes(action) ?? false;
}
```