Role-based access control (RBAC) is an access control model in which permissions are assigned to roles, and people receive the roles that match their job. Instead of granting each permission to each person, an organisation defines roles such as finance analyst or support agent and assigns people to them.

How does RBAC work?

1. Roles are defined from job functions.
2. Permissions are attached to each role.
3. People are assigned to the roles they need.
4. When someone changes job, their role assignments change.
5. Roles and memberships are reviewed regularly.

What are the benefits of RBAC?

• Consistency: people in the same job get the same access.
• Less administration: permissions are managed once per role, not once per person.
• Easier audits: access can be explained by role.
• Support for least privilege: roles can be kept narrow.
• Faster joiners, movers and leavers: changing a role changes the access.

What are the main concepts?

A role is a set of permissions. A permission is the right to perform an action on a resource. An assignment links a person to a role. Role hierarchies let one role inherit another, and separation of duties prevents conflicting roles from being held together, such as creating and approving a payment.

How is RBAC different from ABAC?

RBAC decides by the role a person holds. Attribute-based access control decides using attributes such as department, device, location and time. Many organisations use roles as the base and attributes for sensitive cases.

What is role explosion?

When exceptions and special cases lead to so many narrow roles that nobody can manage or understand them. It defeats the simplicity that RBAC was meant to provide.

What is role creep?

The opposite problem. Roles gain permissions over time, people accumulate several roles, and a role that began narrow becomes broad. An account with a long list of roles can end up holding far more than its job needs.

What are common RBAC mistakes?

• Designing roles around individuals instead of jobs.
• Creating roles and never reviewing them.
• Using one broad role for convenience.
• Ignoring separation of duties.
• Leaving administrative roles with too many members.

How do you design good roles?

Start from real jobs, and use usage data to see what permissions are actually needed. Keep the number of roles manageable, give each role an owner, separate administrative roles and review roles and memberships on a schedule.

Does RBAC work for non-human identities?

Yes. Service accounts and workloads can be given roles, and narrow roles are one of the best ways to limit what they can do. Cloud platforms rely heavily on roles for exactly this reason.

What does RBAC look like in cloud platforms?

Cloud platforms rely on roles and policies. Built-in roles are often broad, so organisations create custom roles and assign them at the narrowest scope that works. Reviewing which identities hold powerful roles is one of the most useful checks in a cloud environment.

How is RBAC different from access control lists?

An access control list attaches to a resource and names who may use it. RBAC attaches permissions to roles and gives the roles to people. ACLs are precise but hard to manage at scale, while roles are easier to explain and review.

How often should roles be reviewed?

Regularly, and whenever a job changes. Privileged and administrative roles deserve the most frequent review, because they are where excess permissions do the most harm.

What are the limits of RBAC?

It is static. A role says what is allowed, not whether a particular use is normal. A valid account that acts within its roles looks legitimate to the policy, so an attacker or insider who holds a role can use it without being stopped.

How does RBAC support compliance?

NIS2 and DORA expect access control and the ability to justify who has access to critical systems. Roles make that easier to show, provided they are reviewed.

Sharelock reviews the access that roles grant, to show where it is excessive or unused, and monitors behaviour after login, down to individual transactions and queries on critical applications.

‍