# Designing Role-Based Access Control That Goes Beyond Roles
A role name alone rarely answers every authorization question in a real business application.
Humzio includes organization administrators, HR roles, managers and employees. As the permission model grew, we found that authorization also needed to understand hierarchy and context.
Important safeguards
An administrator should not be able to silently grant themselves more authority. A lower-level role should not be able to modify a higher-level one. The system should also protect the last administrator from accidental removal.
Session handling matters too. When a user's authority is reduced, existing sessions should not continue behaving as if the old permissions still apply.
The lesson
Good RBAC is not simply a table of roles and permissions. It combines permissions, organizational scope, hierarchy, session lifecycle and explicit safeguards around sensitive actions.