Role-Based Access Control (RBAC)
Learn what role-based access control (RBAC) is and how Permit.io models it. This page is for developers choosing a policy model before they build a policy.
What is RBAC?
Role-based access control (RBAC) is an authorization model that grants permissions to users based on their roles. You group users by their common responsibilities into roles, grant each role the actions it can perform on each resource, and assign one or more roles to each user.
In an HR department, only HR managers can update employee details. Other employees can only view their own details.
In Permit, you create roles, resources, and actions on the Policy screen, select the actions each role can perform in the Policy Editor, and assign roles to users per tenant on the Directory screen. For the definitions of roles, resources, and actions, see RBAC components.
RBAC was introduced in a 1992 NIST paper by David Ferraiolo and Richard Kuhn, presented at the 15th National Computer Security Conference. NIST's model was later formalized as the American National Standard ANSI INCITS 359-2004, described on NIST's RBAC standards page.
Try an interactive RBAC demo
The interactive demo walks through creating an RBAC policy in the Permit dashboard.
When to use another model
RBAC works when a user's job function decides what they can do. Use another model when access depends on more than the role:
- Use attribute-based access control (ABAC) when access depends on attributes such as location, time, or plan.
- Use relationship-based access control (ReBAC) when access depends on ownership or a hierarchy of resources.
To compare the models and combine them in one policy, see Mix and Match Policies.
Next steps
- RBAC components: the definitions of roles, resources, and actions.
- Building an RBAC policy: create roles, a resource, permissions, and a user in the Permit dashboard.
- Check permissions with permit.check(): enforce the policy in your code.