Role-Based Access Control

Product overview: RBAC

What is RBAC?

Role-based Access Control is an authorization model that focuses on assigning permissions to users based on their role within an organization. It's the most basic and simple approach to access management. RBAC allows us to analyze the needs of particular users and group them into roles based on common responsibilities. You can then assign one or more roles to each user, and many actions to each role, where each action can or cannot be performed on a specific resource you have defined.

Let's have a look at a simple example of RBAC.

Example

Within a HR Department, only HR Managers can update employee details, while other employees can only view their details.

Fun fact

RBAC was introduced in a 1992 NIST paper by David Ferraiolo and Richard Kuhn, presented at the 15th National Computer Security Conference. NIST's model was later formalized as the American National Standard ANSI INCITS 359-2004, described on NIST's RBAC standards page.

Let's try a simple demo!