What is Role Based Access Control?
Also called RBAC.
Role based access control is an authorization model in which permissions are attached to named roles, and users receive access by being assigned those roles rather than by receiving permissions individually. Changing what a role can do changes access for everyone holding it. The model is generic and standardized, independent of any particular vendor or product.
The core elements are users, roles, permissions, and sessions. A permission is an allowed operation on a resource, a role groups the permissions that correspond to a job function, and an assignment binds a user to one or more roles. Role hierarchies let a senior role inherit the permissions of a junior one, which reduces duplication across large permission sets.
The model's value is administrative. Reviewing a few dozen role definitions is tractable, whereas reviewing per user permission grants across thousands of accounts is not. Constraints can be layered on top, such as separation of duty rules that forbid one person from holding two conflicting roles, and cardinality limits that cap how many people hold a sensitive role.
Known weaknesses include role explosion, where fine grained needs produce almost as many roles as people, and role creep, where accumulated assignments outlive the reason they were granted. Periodic access review, time bounded assignment, and removal on role change are the standard remedies. Attribute based access control is often combined with roles when decisions must also depend on context.
Role based access control is an authorization mechanism and does not authenticate anyone by itself, so it is deployed alongside authentication and, in multi tenant systems, alongside isolation that prevents cross tenant access regardless of role. Applying least privilege when defining roles, and logging authorization decisions to an audit trail, are what make the model useful in practice.
Key points
- Permissions attach to roles, and users are assigned roles.
- Simplifies review and revocation at scale.
- Supports hierarchies and separation of duty constraints.
- Vulnerable to role explosion and stale assignments.
- Complements, but does not replace, authentication and isolation.
In practice
A records system defines three roles. Viewer can read records, editor can read and modify them, and administrator can additionally manage users. A new analyst is assigned viewer and gains exactly those permissions. When the compliance team decides viewers should no longer see identifiers, they edit one role definition, and every viewer is affected at once without touching individual accounts.