←  All terms
R
Enterprise & Governance

Role-Based Access Control

Role-based access control assigns permissions through defined roles rather than configuring every user individually.

Role-Based Access Control groups permissions into defined roles that can be assigned according to a user’s responsibilities. This makes access easier to manage consistently across teams and reduces the need for individual permission settings. Clear role definitions, documented ownership, and regular access reviews help prevent unnecessary privileges and support effective governance. The concept is closely related to Governance and Single Sign-On.

Read more

Governance

Single Sign-On

SCIM

Audit Log

FAQ

Role-Based Access Control

At what point does role-based access control pay off in organizations?
Once several teams, external partners, or approval processes are involved. For a handful of people with identical duties, simple permission assignment is often enough. The benefit grows with user count and audit requirements, especially when combined with central user management through SCIM or single sign-on.
What mistakes commonly occur with role-based access control?
Role explosion is typical: every special case spawns a new role until nobody keeps track. Equally common are over-privileged catch-all roles and missing reviews, so permissions persist after team changes. Regular recertification counteracts this. A role catalog with named owners keeps the model manageable.
How is a role model designed for role-based access control?
The starting point is tasks, not people: who needs to do, view, or approve what? From that, a few clearly named roles emerge, following the principle of least privilege. Each role gets an owner and a description. Exceptions are documented instead of turning into new special-purpose roles.
How does role-based access control differ from individual permissions?
With individual permissions, every account receives each right separately; with role-based access control, rights attach to roles. A change of duties then means a role change instead of many single edits. This reduces errors and simplifies audits, but it requires a well-thought-out role model up front.