Built a full-stack web application with role-based access control (RBAC), enforcing per-role privilege restrictions across all routes and features. The system supports multiple user roles (Admin, Manager, User), each with distinct access permissions managed server-side. Implemented secure session handling, protected API endpoints, and dynamic UI rendering based on role. Designed with security best practices to prevent unauthorized access and privilege escalation.