Key Takeaways
- RBAC assigns permissions to roles and roles to people, rather than permissions directly to people.
- The model was formalized in 1992 by David Ferraiolo and Rick Kuhn at NIST.
- The INCITS 359 standard describes the RBAC reference model.
- Fewer, clearly defined roles are easier to audit than many individual permissions.
How does role-based access control work?
RBAC connects people, roles, and permissions through two assignments.
- Permissions are assigned to a role, such as approving invoices for the Accounting role.
- People receive one or more roles.
- When someone's job changes, the role is swapped instead of editing individual permissions.
- Mutually exclusive roles can be separated, such as creating an invoice and approving an invoice.
Why is RBAC important for small and medium-sized businesses?
RBAC makes granting permissions faster, more consistent, and auditable. Instead of deciding from scratch which permissions someone needs at every new hire, an appropriate role is assigned. During audits and customer information security questionnaires, you can then show which role holds which permissions. For small businesses, five to ten roles are often enough.
Example: Role-Based Access Control (RBAC) in practice
Example: An IT service provider with 80 employees defines 6 roles: Management, Sales, Project Management, Engineering, Accounting, and Administration. The Sales role receives CRM access, quote templates, and read-only access to projects. When someone moves from Sales to Project Management, IT swaps one role instead of adjusting 15 individual permissions.
Role-Based Access Control (RBAC) vs. Attribute-Based Access Control (ABAC)
| Aspect | Role-Based Access Control (RBAC) | Attribute-Based Access Control (ABAC) |
|---|---|---|
| Basis | The person's role | Attributes of the person, resource, and environment |
| Example rule | Accounting role may approve invoices | Finance department may approve invoices up to 5,000 euros only on the corporate network |
| Setup | Manageable: define and assign roles | More complex: maintain rules and attributes |
| Typical use | Most SaaS applications and SMBs | Fine-grained rules in large or regulated environments |
RBAC makes access decisions based on the assigned role, whereas ABAC uses freely combinable attributes such as department, location, or time of day.
How does Sovaro help with Role-Based Access Control (RBAC)?
Sovaro does not implement role models inside target applications; that happens in the respective tool or identity provider. Within Sovaro, there are roles for HR, IT, and Finance, and each role sees only what it needs. Tasks in onboarding and offboarding go to HR, IT, managers, and tool admins.