How do you design authorization for a system where permissions vary by team, resource and plan?

Separate authentication from authorization, then choose a model: role based access control is simple and works when permissions cluster into a handful of roles, while attribute based rules suit conditions on the resource, such as owner, team or plan. Enforce it in one place, ideally a policy layer the handlers call, keep checks close to the data so a query cannot leak rows, and log every decision for audit.

Authentication answers who you are and happens once at the edge; authorization answers what you may do and happens on every request against a specific resource. For a model, I start with roles because they are easy to reason about and easy to explain to support, then add attribute conditions where roles alone cannot express it, things like this user is on the plan that includes exports, or this record belongs to their team. What matters more than the model is that there is exactly one place that decides. I want a policy function per resource type that handlers call, defaulting to deny, so adding a new endpoint that forgets the check is a visible omission rather than a silent hole. For anything multi tenant I also push the tenant filter into the data layer so a query physically cannot return another tenant's rows, because relying on every developer remembering a where clause fails eventually. And every decision is logged with the subject, resource and result, since the first question in any incident is who could see what.