RBAC with internal authentication backend - Phase 2