RBAC
acronymcloudsecurityIT support
Role-Based Access Control: permissions granted to roles, people assigned to roles - access managed by job, not by individual favor.
ABAC extends it with attributes (department, time, device); both exist to make revocation possible.
Role-based access control grants permissions to roles and assigns people to roles, rather than granting permissions to individuals. The benefit is reviewability: a role can be examined once and understood, where a thousand individual grants cannot.
Its characteristic failure is role explosion. Every exception becomes a new role, the set grows past the point anyone can reason about, and the model provides the paperwork of governance without the clarity it was adopted for. The discipline is to keep roles aligned to job functions rather than to requests, to handle genuine exceptions as time-bounded grants rather than permanent roles, and to review the set periodically, because a role nobody can explain is a role nobody should be assigned.