Permissions are the product

A permission bug is usually a model that does not match how the organization decides. “Manager can edit employees” fails the moment salary and address belong to different people.

Start from the record and the action: who may read the field, change the state, approve the move. The API refuses what the screen does not offer. A flat role table is how sensitive data leaks.