GLOSSARY

An access-control model in which permissions are assigned to organisational roles and users receive permissions through their role assignments.

RBAC simplifies permission administration at scale, supports least privilege, and provides an auditable connection between job responsibilities and system access.

A finance-analyst role can view invoices and reports, while a payment-approver role can authorise payments. Separation-of-duty rules prevent one user from holding both capabilities without exception approval.

Poor role design causes role explosion or excessive access. RBAC handles contextual and fine-grained decisions less naturally than attribute-based approaches and still requires lifecycle management and access reviews.

RBAC separates users, roles, permissions, sessions, and constraints. Role hierarchies can inherit permissions, while separation-of-duty rules prevent conflicting assignments or activations. Roles should reflect stable job responsibilities and be governed through approval and review.