A person may hold multiple roles, and roles may inherit permissions through a hierarchy, subject to constraints such as separation of duties.
RBAC reduces the need to manage each person’s entitlements separately. Role design starts by identifying repeatable functions, mapping the minimum permissions needed for each function, assigning accountable owners, and defining incompatible combinations. Joiner, mover, and leaver processes then update role membership as responsibilities change.
Key points
PurposeMake authorization more consistent and reviewable by connecting permissions to defined organizational functions.
Core relationshipsAdministrators assign identities to roles and permissions to roles; a session may activate one or more roles that the identity is authorized to use.
Governance needReview role definitions, membership, inheritance, unused permissions, and separation-of-duties conflicts rather than approving a role only once.
Important limitationPoorly designed roles can accumulate excessive access or produce hundreds of narrow roles. RBAC does not evaluate every contextual factor, so some decisions may also need attributes or policy rules.