And RBAC will be there too as you can set any custom property in the session when creating it. So one property you could set is a role, which can then be read in any API post session verification