Casbin RBAC is not if admin. It is (user, object, action)
How we wired Casbin into an internal IT helpdesk. The model only defines grammar, policies live in Postgres, handlers enforce capabilities, SQL limits rows, and the UI only hides entry points.