Custom Role-Based Access Control System for a Healthcare Data Platform

Overview

Built a custom role-based access control system for a healthcare data platform that needed far more granular permission logic than its off-the-shelf authentication provider supported. The system lets administrators define access rules down to the level of which specific data fields a given role can view, edit, or export, with every access event logged for audit purposes. This addressed a real compliance gap: the platform's prior all-or-nothing permission model meant staff often had access to more sensitive data than their role actually required. We built the system to integrate with the platform's existing identity provider rather than replacing its authentication layer entirely. A healthcare data platform's off-the-shelf authentication provider only supported an all-or-nothing permission model, meaning staff often had access to more sensitive data than their role actually required. We built a custom role-based access control system letting administrators define access rules down to specific data fields per role, with every access event logged for audit purposes, integrated with the platform's existing identity provider rather than replacing authentication entirely. We mapped every role's actual data-access needs against what the old all-or-nothing model was granting, working directly with the client's security team to define correct field-level rules. The new system ran in shadow mode, logging what it would have restricted, before being enforced live. The system closed a data-access compliance gap flagged in the client's own internal security review, giving them field-level access control they previously couldn't offer at all.