Role-based access control assigns permissions to roles, then assigns roles to users or services.
Role-based access control, or RBAC, is an authorization model that controls access through roles instead of assigning every permission directly to every user.
A role represents a job or responsibility, such as support agent, manager, or administrator. Each role has a defined set of permissions.
Think of RBAC like access badges in an office building.
People receive badges based on their job. A support badge opens support areas, while an administrator badge opens additional areas.
The building manager changes the access rules for a role instead of editing every badge one by one.
Analogy:
RBAC keeps authorization rules organized and makes access easier to review as an application grows.
Collect related permissions into a named role.
Give users or services roles that match their work.
Change one role definition instead of many user records.
Make it easier to see who can perform sensitive actions.
RBAC is common in applications where different people or services need different levels of access.
Separate access for employees, managers, and administrators.
Limit sensitive settings and maintenance actions.
Control who can view, deploy, or change resources.
Give an automated service only the permissions it needs.
Role: support_agent Permissions: - ticket.read - ticket.update User: Maya Assigned role: support_agent
When Maya tries to update a customer ticket, the system checks her role, finds the matching permission, and allows the action. The same role can be assigned to other support agents.
The role is not the user and the permission is not the resource. RBAC connects them through an authorization decision.
Authentication identifies the caller. RBAC helps authorization decide whether that caller may perform a specific action.
Groups permissions into roles and assigns those roles to users or services.
Checks who or what is making a request. It does not by itself decide what the caller may do.
Describes an allowed action or access rule. A role can contain many permissions.
RBAC is an authorization design. It normally works after identity has been established.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| RBAC | 基于角色的访问控制 | An authorization model that uses roles to organize access. | 通过角色来组织和控制访问权限的方法。 |
| Role | 角色 | A named set of responsibilities or permissions. | 代表一组职责或权限的名称。 |
| Permission | 权限 | An allowed action on a resource. | 对某个资源允许执行的操作。 |
| Authorization | 授权 | Checking what a caller is allowed to do. | 检查调用方被允许做什么。 |
| Resource | 资源 | A thing that a system protects or manages. | 系统需要保护或管理的对象。 |
| Least Privilege | 最小权限 | Giving only the access needed for a task. | 只给完成任务所必需的权限。 |
| Service Account | 服务账号 | An identity used by software instead of a person. | 由软件使用而不是由人直接使用的身份。 |
RBAC controls access by assigning users or services to roles and assigning permissions to those roles.
Good role design keeps access understandable, reviewable, and limited to what each responsibility requires.
Core Flow:
User → Role → Permission → Authorization Decision