RBAC (role-based access control)
Also called role-based access control.
An access model where permissions are attached to roles, and people get access by being given a role.
Last updated
What it is.
In RBAC you define roles such as viewer, editor, billing admin and owner. Each role carries a set of permissions, like view invoices or invite users. A person can do something only if one of their roles allows it. NIST published a standard RBAC model, later adopted as ANSI/INCITS 359.
When rules depend on the data itself, such as a manager seeing only their own team, RBAC is often combined with attribute-based checks. Many products use roles for the broad strokes and per-record rules for the rest.
Why it matters
Enterprise customers expect to control who can see and change what, and auditors check that access matches job need. RBAC keeps that manageable: change a role once instead of editing hundreds of users. It also underpins controls like maker-checker, where the person who approves must hold a different role.
In a product build
We check permissions on the server for every action, in one shared policy layer, never only by hiding buttons in the UI. Roles and their permissions are data, so customers can be given custom roles later without a code change.
Common mistakes.
- 01
Checking roles only in the front end, so the API still accepts the call.
- 02
Hard-coding role names across the codebase, which makes new roles a big change.
- 03
Role explosion: a new role for every special case until nobody knows what each one does.
Read the official text.
Primary sources this definition is based on.
- NIST, Role Based Access Control project (ANSI/INCITS 359)checked 2026-10-25
Work it out with a tool.
Related terms.
- Audit logA record of who did what in a system, when and from where, kept so actions can be traced later.
- SSO (single sign-on)One login, managed by an identity provider, that gives a person access to many separate apps.
- Maker-checker (four-eyes principle)A control where one person makes a change and a different person must approve it before it takes effect.
- Multi-tenancyOne running copy of a software product serving many customers, called tenants, with each tenant's data kept apart.
- OAuth 2.0A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
