What is Role-Based Access Control (RBAC)?

RBAC is an access-control model that grants permissions based on a user’s role in the organisation, rather than assigning rights to each person individually.

It simplifies access management, supports least-privilege, and makes access easier to review and audit.

What is the difference between RBAC and ABAC?

RBAC grants access based on predefined roles, while ABAC (attribute-based access control) grants access based on attributes such as department, location or time.

RBAC (Role-Based Access Control) - Glossary

Role-Based Access Control (RBAC) is an access management model in which permissions are assigned to roles rather than to individual users. Users are then granted one or more roles that collectively determine what resources and actions they may access. This approach simplifies administration considerably in larger organisations, as changes to permissions only need to be made at the role level.

RBAC is a cornerstone of the principle of least privilege and supports compliance with frameworks such as ISO 27001, SOC 2 and the GDPR. By aligning roles with job functions, organisations can reduce the risk of excessive access rights and streamline access reviews during internal or external audits.

Frequently asked questions

What is Role-Based Access Control (RBAC)?: RBAC is an access-control model that grants permissions based on a user’s role in the organisation, rather than assigning rights to each person individually.
Why use RBAC?: It simplifies access management, supports least-privilege, and makes access easier to review and audit.
What is the difference between RBAC and ABAC?: RBAC grants access based on predefined roles, while ABAC (attribute-based access control) grants access based on attributes such as department, location or time.

RBAC (Role-Based Access Control)

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

Z

Frequently asked questions