The basic scenario for authorization is to give a user one or more roles in an application. The same user can of course ha a different set of roles in another application.
But what if the same user has different relations to the application?
Example: insurance company
- Customer - basic privileges to see and modify own insurances
- Employee - administration privileges
- Board member - access to top-secret financial statistics
The naive approach is to give the person the flat list of all roles and privileges needed.
To support such a use case some information is needed to differentiate which "hat" the person