There’s a very good implementation of Wireguard with RBAC. It’s called Tailscale.