Role-based access control (RBAC)

Role-based access control (RBAC) is a method of restricting access to application functionality and data based on the roles assigned to individual users within the application.

In RBAC for an application, roles are defined based on the tasks and responsibilities that a user needs to perform within the application. These roles are then associated with sets of permissions that determine what actions a user with that role can perform.

For example, consider a project management application. Roles could be defined for “project managers”, “team members”, and “administrators”. The “project managers” role might have permissions to create and manage projects, assign tasks to team members, and generate reports. The “team members” role might have permissions to view assigned tasks, update task status, and communicate with other team members. The “administrators” role might have permissions to manage user accounts, configure system settings, and perform other administrative tasks.

Once roles are defined and associated with permissions, users can be assigned to those roles, and their access to application functionality and data will be restricted accordingly. For example, a user assigned to the “team members” role would only be able to perform the actions associated with that role, while a user assigned to the “project managers” role would have additional permissions to perform project management tasks.

RBAC is the most common way to handle access control and for many applications it is the only available option, but there are several downsides with RBAC specially when several organisations use your digital services:

Conflicting roles: If multiple organizations are using the same application, they may have different ways of defining roles and permissions. This can lead to conflicts when trying to assign roles and permissions across organisations, especially if there is no standard way to define roles and permissions.

 

1. Complexity

The more organisations that are using the application, the more complex the RBAC system becomes. This can make it difficult to manage roles and permissions across all organizations, especially if there are many different roles and permissions that need to be defined.

 

1. Access creep

Over time, users may accumulate additional roles and permissions that they no longer need, leading to access creep. This can increase the risk of unauthorized access or data breaches, as users may have more access than necessary.

 

1. Limited customization

RBAC systems may not allow for granular customization of roles and permissions for each organisation. This can lead to situations where organisations must accept a one-size-fits-all approach to RBAC, which may not align with their specific needs.

 

If possible, we recommend a permission-based access control instead.