At the risk of nit picking, this appears to move into the realm of an ABAC not an RBAC. The difference is that in an RBAC, permissions are determinable on the basis of whether the permissions required for the operation overlap with the permissions granted by the users roles. In an ABAC (Attribute Based Access Control) properties of the entities the operation is being performed on are allowed to be relevant.
The danger with ABAC is I think well exemplified in this. It becomes very tempting to try to implement far too much business logic in the permission system layer. Not all validation failures are access control limitations.
Personally I have come to prefer RBAC inside of scopes. It ends up being far easier to reason about.
