Role-Based Access Control (RBAC)

Role-Based Access Control assigns permissions to abstract roles (for example, "billing-admin" or "read-only auditor") and grants users access by adding them to those roles. This indirection simplifies administration, supports separation of duties, and makes audits straightforward because permissions are documented per role rather than per user. RBAC is the dominant model in enterprise IAM, cloud platforms (AWS IAM, Azure RBAC, Kubernetes RBAC), and ERP systems. Its main weakness is role explosion in large organisations where business needs are highly granular; this often pushes teams toward hybrid approaches that combine RBAC with attribute-based rules.