Role-based access control, or RBAC, assigns system permissions to defined job roles rather than individually granting every permission to each user. Users receive access through the roles needed for their responsibilities.
How does RBAC work?
Administrators define roles, attach permissions and assign users to those roles. A payments system might separate beneficiary maintenance, payment preparation, approval and administration.
Why is RBAC useful?
- Consistent access provisioning
- Faster onboarding and role changes
- Support for least privilege
- Clearer access reviews
- Better segregation of duties
RBAC vs. attribute-based access control
RBAC grants access through roles. Attribute-based access control evaluates attributes such as user, resource, location and transaction context. Organizations can combine both.
What risks remain?
Poorly designed roles can accumulate excessive permissions, and one user can receive conflicting roles. Shared accounts and emergency access also weaken accountability.
How should access be governed?
Assign role owners, approve assignments, review access periodically, remove access promptly and log privileged actions. Test toxic combinations such as creating and approving the same payment.
