RBAC System
├── Data Layer (Firestore)
│   ├── teams/{teamId}/members/{userId}
│   └── invitations/{inviteId}
├── Enforcement Layer
│   ├── Firestore Security Rules
│   └── API Middleware (checkPermission)
└── UI Layer
    ├── Role-gated components
    └── Permission hooks (usePermission)

interface TeamMember {
  userId: string;
  email: string;
  displayName: string;
  role: 'owner' | 'admin' | 'member' | 'viewer';
  joinedAt: Timestamp;
  invitedBy: string;
}

interface Invitation {
  id: string;
  teamId: string;
  email: string;
  role: 'admin' | 'member' | 'viewer';
  status: 'pending' | 'accepted' | 'expired';
  createdBy: string;
  createdAt: Timestamp;
  expiresAt: Timestamp; // 7 days from creation
}

const PERMISSIONS: Record = {
  owner:  ['view', 'create', 'edit', 'delete', 'comment', 'manage_members', 'billing', 'transfer_ownership'],
  admin:  ['view', 'create', 'edit', 'delete', 'comment', 'manage_members'],
  member: ['view', 'create', 'edit', 'comment'],
  viewer: ['view', 'comment'],
};

match /teams/{teamId}/tickets/{ticketId} {
  allow read: if isTeamMember(teamId);
  allow create, update: if hasPermission(teamId, 'edit');
  allow delete: if hasPermission(teamId, 'delete');
}

function isTeamMember(teamId) {
  return exists(/databases/$(database)/documents/teams/$(teamId)/members/$(request.auth.uid));
}

function hasPermission(teamId, permission) {
  let member = get(/databases/$(database)/documents/teams/$(teamId)/members/$(request.auth.uid));
  return permission in PERMISSIONS[member.data.role];
}

function usePermission(permission: Permission): boolean {
  const { currentTeamMember } = useTeamContext();
  if (!currentTeamMember) return false;
  return PERMISSIONS[currentTeamMember.role].includes(permission);
}

// Usage in components:
function DeleteTicketButton({ ticketId }: { ticketId: string }) {
  const canDelete = usePermission('delete');
  if (!canDelete) return null;
  return  deleteTicket(ticketId)}>Delete;
}