Peaklight

In information security, role-based access control (RBAC) or role-based security is an approach to restricting system access to authorized users. It is a policy-neutral computer access control mechanism defined around roles and privileges. The components of RBAC, such as role-permissions, user-role and role-role relationships, make it simple to perform user assignments. RBAC can be used to facilitate administration of security in large organizations with hundreds of users and thousands of permissions. Although RBAC is different from mandatory access control and discretionary access control (DAC) frameworks, it can enforce these policies. Its approach is also different from context-based access control and access-control lists. Attribute-based access control and relationship-based access control are models that build on the concept of RBAC. A 1990s study by NIST demonstrated that RBAC addresses many needs of commercial and government organizations. RBAC is still commonly considered a best practice in information security management, including in implementation of information security standards related to access control.