Role hierarchy + permission guards
STAFF < TEAM_LEAD < MANAGER < ADMIN role ladder plus an isSuperAdmin tier. Guards make permission errors loud and uniform.
in production, no sandbox here
This one runs in Broomstick Hub and Beeline Medical. It has no sandbox on this site, because the pattern only means anything against a real database, real roles, and real money. Rebuilding that as a toy would demonstrate the toy.
The write-up covers how it works and where it is deployed.