Role-Based Access Control (RBAC)

Each user is assigned one or more roles, and each role is assigned one or more privileges. A role typically reflects the permissions needed to perform defined functions in an organization and may apply to one person or to several. Roles can be arranged in a hierarchy through which permissions are inherited, and the relationship between users and roles can be many-to-many.

RBAC addresses the cost and error of specifying access control lists for each user individually. Security is managed at a level that corresponds closely to the organization's structure. Administration consists of deciding which operations people in particular jobs must perform and assigning employees to the proper roles.

RBAC was formalized in 1992 by David Ferraiolo and Rick Kuhn. The NIST RBAC model was adopted as an American National Standard, ANSI/INCITS 359-2004, in 2004 and revised as INCITS 359-2012. The standard defines basic elements (users, roles, permissions, operations, and objects) and the features an RBAC system requires.

RBAC decisions rest on the presence or absence of roles, which handles object-level and horizontal access decisions poorly. In large systems with many roles, role checks are easy to miss or get wrong, which can give both too much and too little access. For these reasons OWASP recommends attribute-based or relationship-based access control over RBAC for application development.