That logic is complex, but not that much. The industry is full of RBAC implementations that are orders of magnitude worse, and don't necessarily do what their owners think they do.