Role-based access control
RBAC connects permissions to roles and assigns people to those roles. The data scope must be clear alongside the role name.
Role-based access control (RBAC) connects permissions to roles and assigns people to those roles. A role can represent the duties of a reader or an order placer. Permissions must describe the allowed actions concretely.
Role and data scope
In a hypothetical customer portal, a customer administrator may manage accounts for her own company. The role name gives her no administrative power over other customer companies. Access decisions must enforce that boundary.
RBAC does not remove the need to plan resources and scope. Some rules require additional properties, such as the company a document belongs to. Roles and attribute-based checks can therefore work together. Merely increasing the number of role names does not resolve that boundary.
Sources
Related terms
- Identity and access managementIAM combines management of digital identities with their access rights. Accounts, role changes and removal of old permissions belong together.
- Attribute-based access controlABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- WebAuthnWebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- Multi-factor authenticationMFA uses different types of authentication factors. Asking for the same factor type several times does not create a multi-factor check.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.