B2B SaaS permissions that actually scale

Stop hard-coding role checks. Bailiff gives you multi-tenant isolation, RBAC, and fine-grained permissions in one API call.

The scenario

You're building a B2B SaaS product. Each customer has their own workspace with teams. Users have roles like Admin, Editor, and Viewer. You need complete isolation between tenants, and the role system needs to grow with your product.

Tenant A
A
Admin
E
Editor
V
Viewer
Isolated
Tenant B

The problem with hard-coded logic

Scattered role checks

Every endpoint has its own if (user.role === 'admin') check, and they don't always agree.

No tenant isolation

You rely on WHERE clauses and careful coding to prevent cross-tenant data access.

Rigid role system

Adding a new role means touching every permission check in your codebase.

No audit trail

When something goes wrong, you can't answer "who had access to what, and when?"

How Bailiff models it

Tenants as groups

Each customer workspace is a group. Users belong to their tenant's group and are automatically isolated from others.

await bailiff.assign(user, 'admin', 'tenant:acme');

Roles with fine-grained permissions

Define roles (Admin, Editor, Viewer) and map them to permissions per resource type. Change a role's permissions in the dashboard and it takes effect immediately.

const allowed = await bailiff.check(user, 'delete', 'project:123');

Explainable decisions

Every check returns the full path: user → tenant → role → permission → resource. Debug instantly; audit effortlessly.

Try it in the playground

The Workspace CRM scenario demonstrates multi-tenant RBAC with role-based permissions and tenant isolation.