RBAC permissions data model

erDiagram
    USER ||--o{ USER_ROLE : has
    ROLE ||--o{ USER_ROLE : "assigned to"
    ROLE ||--o{ ROLE_PERMISSION : grants
    PERMISSION ||--o{ ROLE_PERMISSION : "granted by"
    USER {
        int id PK
        string email
    }
    ROLE {
        int id PK
        string name
    }
    PERMISSION {
        int id PK
        string action
        string resource
    }
    USER_ROLE {
        int user_id FK
        int role_id FK
    }
    ROLE_PERMISSION {
        int role_id FK
        int permission_id FK
    }