What is Role-Based Access Control (RBAC)?
An authorization model where permissions attach to roles, and users gain access by being assigned those roles.
Definition
RBAC assigns permissions to roles — admin, editor, billing-manager — and grants users access through role membership, rather than attaching permissions to individuals. This keeps authorization auditable and manageable: onboarding an engineer means assigning one role, not fifty permissions, and reviewing access means reviewing role definitions. Kubernetes RBAC binds roles to service accounts; AWS IAM and most SaaS admin panels follow the same shape. Limitations appear when access depends on context or resource ownership ('editors can modify only their own team's documents'); attribute-based (ABAC) and relationship-based (ReBAC) models, implemented by tools like OPA and SpiceDB, address those cases.