What is Role-Based Access Control (RBAC)?
Role-Based Access Control (RBAC) is an access control model that assigns permissions to roles rather than to individual users, so that a user's access is determined by the role or roles they hold. It is used to enforce least-privilege access at scale across applications, systems, and data.
What it is
RBAC is a formal model for controlling who can do what inside a system. Instead of granting permissions directly to each person, an administrator defines roles that represent job functions, such as "read-only analyst" or "database administrator." Permissions are attached to those roles. Users are then assigned to one or more roles, and they inherit exactly the permissions those roles carry.
The model has three core relationships:
- Users are assigned to roles.
- Roles are assigned permissions.
- Permissions map to specific operations on specific resources.
When a user's job changes, an administrator reassigns their role rather than editing a long list of individual permissions. When a role's scope changes, every user in that role is updated at once.
Why it matters
Managing permissions per user does not scale. An organization with 500 employees and 30 applications can easily accumulate thousands of individual permission entries. Auditing them is slow and error-prone. RBAC reduces that complexity by making roles the single point of control.
RBAC also supports compliance. Regulations such as SOX, HIPAA, and ISO 27001 require demonstrable least-privilege access. A well-defined role structure makes it straightforward to show auditors exactly what each job function can access and why.
Separation of duties is easier to enforce with RBAC. A role for "payment approver" and a role for "payment creator" can be defined so that no single user holds both at the same time.
How tools address it
Identity Governance and Administration (IGA) platforms are the primary tools built around RBAC. They provide role lifecycle management, role mining from existing access data, and access certification workflows. Access Management platforms enforce RBAC policies at login and at the API layer. Privileged Access Management (PAM) tools apply RBAC specifically to high-risk administrative accounts. Cloud Infrastructure Entitlement Management (CIEM) tools extend RBAC analysis to cloud provider roles, such as AWS IAM roles and Azure RBAC assignments, where role sprawl is common.