I’m looking for advice on managing roles and policies for API authentication.

For instance, I need to create a role for a manager that grants permissions for creating and editing only.

Currently, our approach involves creating a policy named “Manager” and assigning roles such as “vehicle-create” and “vehicle-edit” to it. Then, we retrieve roles from the policy and assign them to specific users.

However, I’m unsure if this is the correct approach. Could you please advise me on this?

We’re using a Single Page Application (SPA) and need to authenticate via API.