Ask HN: Best practices around RBAC for modern digital banks

Anything people could share on best practices around RBAC for modern digital banks (or perhaps for any type of software, if same applies)?

For example, do you name the roles Prospect, User, Admin, etc.? Or do you use levels to determine the level of access a user has, e.g. L0, L1, L2, ...?

How do you approach naming permissions? Let's say I want to enable adding a payee:

a) create:payees b) create:payees:own c) ???

How about a UK-only payee?

a) create:payees:uk:own b) create:payees:own:uk c) ???

Or would you explicitly name the permission?

a) add_own_uk_payee b) add_uk_payee c) ???

Thanks in advance!