<?php
declare(strict_types=1);
namespace App\Auth;

final class Rbac
{
    private const MATRIX = [
        'admin'    => ['view_events','acknowledge','edit_zones','manage_thresholds','manage_compliance'],
        'operator' => ['view_events','acknowledge','edit_zones'],
        'viewer'   => ['view_events'],
    ];
    public static function can(string $role, string $permission): bool {
        return in_array($permission, self::MATRIX[$role] ?? [], true);
    }
}