RBAC
Role-Based Access Control. Permissions are bundled into roles, users are assigned roles. Simple to understand and audit, but role explosion is a common failure mode at scale. Almost every modern access model starts with RBAC and adds finer-grained controls on top.
RBAC's strength is that a human can read an assignment and understand it, which is why auditors like it and why it will not go away. Role explosion is the standard failure: every exception becomes a new role until there are more roles than users. The workable pattern is a small set of coarse roles for the bulk grant, with attributes or relationships handling the conditions that would otherwise multiply roles.
See also: RBAC vs ABAC vs ReBAC, ABAC, role mining, entitlement
Related on Start with Identity
- GlossaryFine-Grained Authorization (FGA)
Authorization at the level of individual resources or fields, rather than at the application or role level. Critical for multi-tenant SaaS, collaborative docume
- GlossaryReBAC
Relationship-Based Access Control. Authorization is computed by traversing a graph of relationships between subjects and resources. Popularized by Google's Zanz
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GuideFrom RBAC to ReBAC: when and how to migrate
RBAC is great until your customers need to share individual resources, not entire roles. The moment you find yourself adding a 50th role named like `editor_for_
- GuideImplementing RBAC in the Enterprise
A hands-on guide to implementing Role-Based Access Control in the enterprise, covering role modeling, role mining, role hierarchy design, RBAC vs ABAC considera
- GuideKubernetes Identity and Security Guide: RBAC, Service Accounts, and Pod Identity
Secure Kubernetes workloads with proper RBAC configuration, service account hardening, OIDC integration, pod identity, and secrets management best practices.