Keycloak isn’t really for authorization. It’s an openid connect provider so it really does authentication (identifying who the user is). Maybe they’ve been adding features to make it better or you can shoehorn some authorization into the jwt token that your app uses, but that’s generally not a great way to use it.