Role-based access control engine with policy-based permissions