Role-based access control (RBAC)

{
  "id": "MLC-T-CYB-003633",
  "term": "Role-based access control (RBAC)",
  "field": "Cybersecurity",
  "definition": "1. Access control based on user roles (i.e., a collection of access authorizations a user receives based on an explicit or implicit assumption of a given role). Role permissions may be inherited through a role hierarchy and typically reflect the permissions needed to perform defined functions within an organization. A given role may apply to a single individual or to several individuals.\n\n2. A model for controlling access to resources where permitted actions on resources are identified with roles rather than with individual subject identities.\n\n3. mapped to job function, assumes that a person will take on different roles, overtime, within an organization and different responsibilities in relation to IT systems.\n\n4. Access control based on user roles (i.e., a collection of access authorizations that a user receives based on an explicit or implicit assumption of a given role). Role permissions may be inherited through a role hierarchy and typically reflect the permissions needed to perform defined functions within an organization. A given role may apply to a single individual or to several individuals.",
  "abbreviation": "RBAC",
  "references": [
    "CNSSI 4009-2015 from NIST SP 800-53 Rev. 4; NIST SP 800-53 Rev. 4 [Superseded]",
    "NIST SP 800-95 from OASIS XACML Profile for Role Based Access Control (RBAC)",
    "NIST SP 800-16",
    "NIST SP 800-53 Rev. 5",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/role-based-access-control-rbac/"
}