diff --git a/backend/cmd/server/__debug_bin4145769176 b/backend/cmd/server/__debug_bin4145769176
new file mode 100755
index 0000000..300c5e1
Binary files /dev/null and b/backend/cmd/server/__debug_bin4145769176 differ
diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index c119eca..eabd781 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -33,6 +33,8 @@ import (
 func main() {
 	loadDotEnv(".env")
 
+	config.TestRoleYAML()
+
 	seedCount := flag.Int("seed", 0, "seed N fake users at startup (0 to skip)")
 	flag.Parse()
 
diff --git a/backend/configs/endpoints.json b/backend/configs/endpoints.json
new file mode 100644
index 0000000..e69de29
diff --git a/backend/configs/roles.yaml b/backend/configs/roles.yaml
new file mode 100644
index 0000000..defc68b
--- /dev/null
+++ b/backend/configs/roles.yaml
@@ -0,0 +1,11 @@
+role: admin
+permissions: 0
+roles:
+  - role: manager
+    permissions: 0
+    roles:
+      - role: user
+        permissions: 0
+        roles:
+          - role: guest
+            permissions: 0
diff --git a/backend/internal/auth/roles.go b/backend/internal/auth/roles.go
new file mode 100644
index 0000000..20d578d
--- /dev/null
+++ b/backend/internal/auth/roles.go
@@ -0,0 +1,21 @@
+package auth
+
+type Permission int
+type Role struct {
+	Name        string
+	Permissions Permission
+}
+
+const (
+	AdminPermission Permission = 0xff - (1<<iota - 1)
+	ManagerPermission
+	UserPermission
+	GuestPermission
+)
+
+var Roles = []Role{
+	{"admin", AdminPermission},
+	{"manager", ManagerPermission},
+	{"user", UserPermission},
+	{"guest", GuestPermission},
+}