DataTerminology.comNEW
Also known as: Role-Based Access Control
An authorization model assigning permissions to roles and roles to users.
DESCRIPTION
Role-Based Access Control (RBAC) manages authorizations by grouping permissions into roles, then assigning roles to users. It simplifies administration and enforces separation of duties and least privilege. RBAC supports role hierarchies and constraints. It’s widely used in enterprises and platforms like databases, Kubernetes, and cloud services.
ALTERNATIVE DEFINITIONS
NIST CSRC
RBAC regulates access based on the roles of individual users within an enterprise.
Stresses enterprise role-based restrictions on system access.
OWASP
Role-Based Access Control assigns permissions to specific roles within an organization and users are assigned to those roles.
Focuses on practical assignment of permissions via roles.
RELATED TERMS
IAM Least Privilege Policy Permissions Role Hierarchy Segregation of Duties Authorization Access Control List Entitlements
COMPETING TERMS
Attribute-Based Access Control
KNOWLEDGE AREAS
Data Security Data Governance Data Management Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Application Administrator IT Manager Cloud Architect Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - Role-based access control
- NIST - RBAC project overview
- Kubernetes - Platform RBAC documentation
TOP QUESTIONS
Why choose RBAC over ABAC?
RBAC is simpler to administer and audit, especially for stable role structures. ABAC offers more granularity but increases policy complexity.
Category: Alternatives
What are common RBAC mistakes?
Role explosion, ambiguous role definitions, mixing permissions across incompatible duties, and lacking periodic access reviews are common issues.
Category: Mistakes
How does RBAC enforce separation of duties?
Constraints and role design prevent conflicting permissions from being assigned simultaneously, reducing fraud or error risks.
Category: Definition
What is currently a hot topic around RBAC?
Combining RBAC with ABAC (policy-aware roles) and automating role mining using usage analytics are active areas.
Category: Topic
How do you design RBAC roles effectively?
Align roles with business functions, define clear permission boundaries, implement hierarchies for reuse, and audit regularly.
Category: Requirements
How is RBAC managed in cloud platforms?
Use provider-specific role definitions, IAM policies, and least privilege principles; enforce reviews and logging across services.
Category: Management
What risks exist with poorly implemented RBAC?
Privilege creep, unauthorized data access, audit failures, and operational bottlenecks from misaligned roles can occur.
Category: Risks
How does RBAC relate to access control lists?
RBAC abstracts ACLs by grouping permissions into roles; ACLs operate at resource-level mappings of subjects to permissions.
Category: Definition
Where to start learning RBAC?
Read NIST RBAC materials and platform-specific docs (e.g., Kubernetes, databases), then model roles for a sample application.
Category: Learning