For anyone who wants to learn what a good authorization system looks like take a look at Tailscale's recent blog post: https://tailscale.com/blog/rbac-like-it-was-meant-to-be/

Really, if you're going to be selling to enterprise clients, you want an attribute-based authorization system. If you need help designing it, talk to your IT/Devops/SRE teams, they'll be able to complain about bad auth systems and what they'd want in an ideal world.