# What is Role-Based Access Control (RBAC)?

> Role-based access control (RBAC) is an access-control model in which permissions are assigned to roles representing job functions or responsibilities, and identities receive permissions by being assigned to those roles.

- Canonical URL: https://yellowcube.eu/glossary/role-based-access-control/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A person may hold multiple roles, and roles may inherit permissions through a hierarchy, subject to constraints such as separation of duties.

RBAC reduces the need to manage each person’s entitlements separately. Role design starts by identifying repeatable functions, mapping the minimum permissions needed for each function, assigning accountable owners, and defining incompatible combinations. Joiner, mover, and leaver processes then update role membership as responsibilities change.

### Key points

- **Purpose:** Make authorization more consistent and reviewable by connecting permissions to defined organizational functions.
- **Core relationships:** Administrators assign identities to roles and permissions to roles; a session may activate one or more roles that the identity is authorized to use.
- **Governance need:** Review role definitions, membership, inheritance, unused permissions, and separation-of-duties conflicts rather than approving a role only once.
- **Important limitation:** Poorly designed roles can accumulate excessive access or produce hundreds of narrow roles. RBAC does not evaluate every contextual factor, so some decisions may also need attributes or policy rules.

### Related terms

[Access control](<https://yellowcube.eu/glossary/access-control/>) · [Authorization](<https://yellowcube.eu/glossary/authorization/>) · [Identity and access management (IAM)](<https://yellowcube.eu/glossary/identity-and-access-management/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [Privileged identity management (PIM)](<https://yellowcube.eu/glossary/privileged-identity-management/>)

### Sources

[NIST glossary: Role-Based Access Control](https://csrc.nist.gov/glossary/term/role_based_access_control) · [NIST SP 800-53 Rev. 5, controls AC-2, AC-3, and AC-6](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.