What is a Role-Based Access Control?

In RBAC, an administrator defines roles (admin, editor, viewer, billing-manager) each carrying a bundle of permissions, then assigns users to one or more roles. Access decisions become a lookup — does this user's role permit this action on this resource — instead of a sprawling per-user permission table that drifts out of sync as people join, change jobs, or leave. RBAC matters operationally because it makes least-privilege enforceable at scale: a new hire gets the standard role for their function on day one, and an offboarded employee loses everything the instant their role is revoked, rather than requiring someone to remember every individual grant. It's also the backbone of most SOC 2 and ISO 27001 access-review evidence, since auditors can inspect roles and their permission sets rather than thousands of ad hoc grants. RBAC has limits: it handles broad, job-function-shaped permissions well but struggles with fine-grained, contextual rules (only during business hours, only for records you created) — those cases usually need attribute-based access control layered on top.