Term · 2. Authentication & Authorization
Role-Based Access Control RBAC
Role-based access control (RBAC) assigns permissions to roles, and roles to users — so access is managed at the role level instead of per-user. It scales governance from N×M (users × permissions) to N+M, makes access reviews tractable, and underpins least privilege and separation of duties. The dominant enterprise authorization model, often combined with ABAC for fine-grained rules.
Definition
Authorization model where permissions are assigned to roles, and roles are assigned to users. Simplifies management at scale — instead of managing N×M (users × permissions), manage N+M (users → roles, roles → permissions). NIST RBAC standard (INCITS 359) defines flat, hierarchical, constrained, and symmetric RBAC variants.
- Application
- midPoint: A mechanism for managing of user access to information systems based on a concept of roles.
SailPoint: Role Mining + Role Engineering — discover roles from entitlement patterns
- Standards & regulations
-
- NIST SP 800-53 «role-based access control (RBAC) is an access control model that restricts access to information resources based on the roles of users within an organization.»
- The NIST Model for Role Based Access Control «This paper describes a unified model for role-based access control (RBAC).»
- A Proposed Standard for Role-Based Access Control «This paper describes a proposed standard for role-based access control (RBAC).»
- Sources
-
- NIST RBAC standard (INCITS 359) primary source
Related terms
-
Access Control (AC)
Mechanism that determines whether a principal is permitted to perform a specific action on a specific resource. Includes …
-
Access Management (AM)
Discipline of granting and enforcing access to resources after identity has been established. Encompasses authentication …
-
Attribute-Based Access Control (ABAC)
Authorization model evaluating attributes of subject (role, department, clearance), object (sensitivity, owner), action …
-
Authorization (AuthZ)
Process of deciding whether an authenticated principal is permitted to perform a requested action on a resource. Distinc …
-
Cloud Data Access Governance
Discovery, classification, and access control for sensitive data across cloud data stores (S3, Snowflake, BigQuery, Data …
-
Delegated Administration (DA)
Permission model where administrators delegate specific management functions to other users within scoped boundaries — t …
Frequently asked questions
What is role-based access control (RBAC)?
RBAC grants permissions through roles rather than directly to users: define roles (e.g. 'AP Clerk'), attach permissions to them, and assign roles to people. Reviews and changes happen at the role level, which is what makes governance scale.
RBAC vs ABAC — which should we use?
RBAC is simpler and auditable but can suffer role explosion; ABAC (attribute-based) gives fine-grained, context-aware rules but is harder to review. Most enterprises use RBAC as the backbone and ABAC for specific dynamic decisions — they are complementary, not exclusive.
How does RBAC support compliance?
RBAC makes least privilege and separation of duties enforceable and reviewable: certifications run per role, toxic role combinations are detectable, and auditors can trace who has what and why. It is a core control for SOX, ISO 27001 and similar frameworks.