Role-based access control (RBAC) is a way of managing permissions in software by assigning them to roles, such as 'manager' or 'viewer', and then assigning users to roles. It makes permissions easier to understand and audit than granting rights to individuals, and it must be enforced on the server, not only in the user interface.
Example
In a procurement system: requesters can create purchase requests; approvers can approve requests up to a limit; finance can create purchase orders; administrators manage users. A requester who edits the page to show an 'approve' button still cannot approve, because the server checks the role.
Common mistakes
- Hiding buttons in the interface but not checking permissions on the server
- Forgetting to scope access to the user's organisation in multi-tenant software
- Creating a new role for every exception until nobody understands them
- Never reviewing who holds which role
Limitations and considerations
- Some requirements need attribute-based rules (for example, 'only records in my region') in addition to roles.