I'm working on a meanjs project.  The user roles are set as an array:roles = ['admin', 'user', 'manager'];why not just set it like this?role = 'admin'Why is the convention of an array used rather than just setting a role value as a string?
User roles array vs string
frameworks;user interface;authorization
The whole idea of role based access control is that any user can fulfil multiple roles. In simple system, each role may be a superset of another role, e.g. admin > manager > user. But this doesn't have to be the case.The most obvious example is when we have multiple instances of a resource, and a role only applies to a single instance. E.g. one user could be admin on server-5 and server-3, but not on any other server where they only are a user. This would necessitate a setup likeroles = ['admin-5', 'admin-3', 'user']It is also possible that a system has multiple roles that are separate rather than subsets of permissions. E.g. an FTP server can be configured so that anyone may upload data but not download it, but also in a way that everyone can download data but not upload any. So different users would have different role sets:user1 = ['uploader']user2 = ['downloader']user3 = ['uploader', 'downloader']So why don't we create a super-role that has both permissions? Why not user3 = ['fullaccess']? When permissions are connected to a single role rather than a group of roles, this makes permissions easier to manage (issue, view, revoke) and to implement. To check whether a user may upload:if UPLOADER in roles:  okWith roles that inherit from another, this would either becomeif role == UPLOADER or role == FULLACCESS:  okwhich is difficult to extends when creating a new super-role that includes the uploader permission.Or if we introduce an inheritance system where each permission may involve a complicated check:if role.permits(UPLOAD):  okClearly, these are more complicated. When implementing security, complexity is dangerous. Too easy to introduce a hard-to-see bug that grants anyone permission.Considering that RBAC is simple for both users and developers, it's not surprising it is common in state-of-the-art systems.(This answer does not discuss the difference between roles and permissions, which introduces an additional layer of mappings.)