What is RBAC?

1 min read Updated 2026-02-05

Role-Based Access Control. A method of restricting system access based on the roles of individual users. Simplifies permission management in complex applications.

Related: Authorization Broken Access Control Privilege Escalation

Understanding RBAC

RBAC assigns permissions to roles rather than individual users. Users are then assigned roles. This simplifies administration, improves security consistency, and supports the principle of least privilege. Common in enterprise applications and cloud platforms.

Examples

  • Admin, Editor, and Viewer roles with different permissions
  • Project-specific roles (Project Owner, Contributor, Reader)
  • AWS IAM roles for service accounts

How to Prevent

  • Define clear role hierarchies
  • Assign minimum necessary permissions to each role
  • Regularly audit role assignments
  • Implement role separation for sensitive operations
  • Log role changes and access attempts

Worried about RBAC in your app?

Our security audits identify vulnerabilities like this before attackers do. Get expert manual review of your codebase.

Get a Security Audit Back to Glossary