role-based access control
also: RBAC, role-based authorization
Role-based access control (RBAC) is a security model where user permissions are determined by their assigned role within a system, rather than individual permission grants. Users inherit all permissions associated with their role.
RBAC simplifies permission management by grouping related privileges into named roles. Instead of assigning permissions directly to each user, administrators create roles (like 'admin', 'editor', 'viewer'), define what those roles can do, and assign users to appropriate roles. When a user changes jobs or responsibilities, you simply change their role assignment rather than reconfiguring dozens of individual permissions.
For example, in a web application, you might create three roles: 'moderator' can approve comments, 'author' can create and edit posts, and 'viewer' can only read content. A new team member assigned the 'author' role automatically gains all associated permissions without manual configuration.
RBAC scales better than discretionary access control (DAC) in large systems and reduces the risk of misconfiguration. Linux systems implement RBAC concepts through tools like sudo with role-based sudoers rules, SELinux roles, and application-level frameworks. It's the foundational access control model for most modern enterprise systems.