What is role-based access? Explained with office keycards

In one sentence: Role-based access control (RBAC) is a way of deciding who can see and do what in a system by giving permissions to job roles, such as "Sales" or "Finance", and then giving each person the roles they need, instead of setting permissions person by person.

The everyday picture

Think about an office building with keycards. When you join, reception does not decide door by door what you may open. They look at your job and load the matching card: sales staff get the sales floor, finance staff get the finance floor, and everyone gets the lobby and the kitchen.

Every door has a card reader. When you tap your card, the reader checks whether your card is allowed on that floor. If it is, the door opens. If not, it stays shut, even if you ask nicely.

When someone moves from sales to finance, reception swaps the floors on their card. When they leave, the card is switched off. Nobody has to walk around the building changing locks.

How it works, step by step

1. A user (an employee) gets an account in the system, like a new starter collecting a blank keycard.
2. The user is given one or more roles (job titles on the card), such as "Sales" or "Manager". One role can be shared by many people, and one person can hold more than one role.
3. Each role carries a set of permissions (the floors that job may enter). A permission is an allowed action on something, such as "view invoices" or "edit customer records". NIST, the US standards body, describes RBAC as tying allowed actions to roles rather than to individual people.
4. The system checks on every request (the reader on every door). Each time someone tries to open a page, a file or a button, the system checks whether one of their roles allows it. The OWASP security project advises checking permissions on every request, not just at login.
5. Anything not allowed stays closed (doors without your floor stay locked). Good systems deny by default: if no rule says yes, the answer is no.

Where the picture stops

• A keycard opens a whole floor. Software often needs finer rules, such as "a salesperson may edit only their own customers". Plain roles handle this poorly, so many systems add rules based on details like who owns a record. OWASP notes that other approaches, called attribute-based and relationship-based access control, often suit these finer decisions better.
• A building has a handful of floors. A growing company can end up with hundreds of slightly different roles, a problem OWASP calls "role explosion". Too many roles become hard to check and test.
• A card reader only knows the card. If someone steals your password, the system sees your roles and lets them in. Roles control what an account can do; they do not prove who is using it.

Why it matters for your business

• Less damage when things go wrong. Giving each role only the access the job needs, called least privilege, means a mistake or a stolen account can reach less of your data.
• Faster starts and clean exits. New starters get the right access by being given a role. Leavers lose it all when their account is switched off.
• Easier reviews. Checking ten roles is simpler than checking every person one by one. OWASP warns that access tends to pile up over time ("privilege creep"), so roles should be reviewed regularly.
• Customer trust. Clients expect that only the right people can see their data. Clear roles make that easier to show.

An example

Imagine a 30-person property agency using one system for listings, client files and payments. It sets up four roles: Agent, Office Manager, Finance and Admin. Agents can view and edit listings and client files. Finance can see payments but cannot change listings. Only two people hold Admin. When an agent moves into finance, the office manager swaps one role for another, and the change applies to everything at once.

Frequently asked questions

What does RBAC stand for?

Role-based access control. Access is decided by the roles a person holds, not set separately for each person.

Can one person have several roles?

Yes. A person can hold more than one role, and they get the permissions of each. A team lead in sales might hold both "Sales" and "Manager".

Is RBAC the same as logging in?

No. Logging in proves who you are (authentication). RBAC decides what you may do once you are in (authorisation). A system needs both.

What is the principle of least privilege?

Giving each person, or each role, only the access they need to do their job and nothing more. It limits how far a mistake or an attacker can reach.

Related explainers

• What is encryption? Explained with a sealed envelope
• What is human-in-the-loop? Explained with a manager signing cheques
• What is a zero-day? Explained with a faulty door lock

The DevDrift builds business platforms with clear roles and permissions: see how.

Sources

• NIST Computer Security Resource Center: role-based access control (glossary)
• OWASP Cheat Sheet Series: Authorization Cheat Sheet