What Is Role-Based Access Control (RBAC)?

Role-based access control (RBAC) grants access by a person’s role instead of one permission at a time. You define what each role should be able to do once. Everyone in that role receives exactly that access, and changes carry across automatically. RBAC enforces least privilege, speeds onboarding and offboarding, and makes access reviews faster and cleaner.

How does RBAC work?

Instead of assigning permissions to each individual, you build roles that match the jobs in your institution, then assign people to roles. A role bundles the access that job requires. When someone joins that role, they inherit its access. When they change roles, their access changes with them. When a role’s access needs to change, you update it once and everyone in the role is updated.

An RBAC example in a financial institution

A teller role might include access to the core banking system and the branch applications a teller uses, and nothing more. A loan officer role would include lending systems a teller does not need. A member or customer service role would see profiles and transaction history, while a financial analyst role would have broader reporting access. Each person receives the access their role requires, and no more.

The benefits of RBAC

Least privilege by default. People get only what their role needs, which reduces risk.
Faster onboarding and offboarding. Access is granted or removed by role rather than one item at a time.
Simpler reviews. Reviewing a handful of roles is far easier than reviewing thousands of individual permissions.
Consistency. Two people in the same role have the same access, which is easier to prove to an examiner.

RBAC vs. ABAC

RBAC grants access based on a person’s role. Attribute-based access control (ABAC) grants access based on attributes such as department, location, or time of day. Many institutions start with RBAC because it is simpler to build and review, then add attribute-based rules later where they help.

How Provision uses RBAC

In Provision, you define your role-based access policy once, and the platform uses it to generate reviews and to run onboarding and offboarding. This is the heart of Govern, and it feeds the automated provisioning in Automate. See the RBAC and lifecycle automation solution page.

Frequently asked

What is the difference between RBAC and least privilege?

Least privilege is the goal, giving people only the access they need. RBAC is a method that achieves it by granting access through roles.

Do we need to build every role before we start?

No. Many institutions review current access first, then model roles from what they find.