# RBAC best practices (Sky Lattice blueprint)

- Prefer functional roles (analyst, loader, engineer) composed from access roles per zone.
- Never use `ACCOUNTADMIN` for day-to-day service automation after bootstrap.
- Restricted domains: analysts read `marts` by default; `curated` in prod needs override + decision.
- Environment isolation: default `database_per_env` unless the customer requires account-per-env (record a decision).
- Temporary exceptions must have `expires_on` when possible.
- Brownfield: leave legacy roles in `unmanaged` with a decision rather than silently rewriting them on day one.