Role-Based Access Control (RBAC)
Definition
RBAC assigns access rights based on membership in roles.
An access control model where permissions are assigned to roles and subjects are assigned to those roles; accesses result from role membership and possibly role hierarchies.
Simply explained
Those belonging to the accounting role receive the rights intended for it, not arbitrary other accesses.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
The role "Accounting" is allowed to read and approve invoices but not manage user accounts.
Limits and pitfalls
- Hiding individual exceptions in roles, role explosion, allowing uncontrolled hierarchies or missing separation of duties.
Origin & history
RBAC was formalized in the 1990s and standardized in ANSI/INCITS 359.
Use in mid-sized companies
- Possible example: The role "Accounting" is allowed to read and approve invoices but not manage user accounts.
Frequently asked questions
What does Role-Based Access Control (RBAC) mean?
An access control model where permissions are assigned to roles and subjects are assigned to those roles; accesses result from role membership and possibly role hierarchies. What mistakes should be avoided? Hiding individual exceptions in roles, role explosion, allowing uncontrolled hierarchies or missing separation of duties.
Sources
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: