I am building a website and in it I am trying to follow the rbac (role-based access control) model. Now, the thing is that managers need to send their contract proposals to approvers (people who will see if the company can go with the contract or not).
But, because I have the rbac model where the admin can create many roles, how can I make sure that there will be users who will be approvers of contracts?
I was thinking of having an attribute called is_approver which could be checked when the admin will be registering a new user if he is an approver.
Another possibility was to make the manager choose the users who should receive his contract proposal for approval. But then he would be able to send the contract proposal to users who aren't even responsible for this.
How can I make sure there will be approvers in the system despite the rbac model and that the contract proposal will be submitted to the right users?