[keycloak-user] RBAC : adding permissions to roles

Hello, I have a very basic question and am curious how to model this via keycloak. In my application I have some roles. I want to map each role to a set of permissions so that based on those permissions i can check if the user has access to a specific action/resource in my application server. (pretty much how classically RBAC is done) I am curious if there is a defined pattern/way of modeling such a behavior in keycloak, or would the best way to do this would be to define and map permissions (to roles) in the application (i.e outside keycloak). What is the best practice for such a case? Regards, Avinash