These roles are typical for such an business application and mostly tightly coupled to the corresponding business methods – eg createOrder()  approveOrder() and executeOrder() This works well in a monolithic business application where you can control the security layers as also the business logic