A named set of responsibilities or permissions that can be assigned to a user or service.
A role is a named collection of access responsibilities. Instead of assigning every permission one by one, a system can assign a role such as Viewer, Editor, or Administrator.
The role describes what a user or service is expected and allowed to do. It does not, by itself, prove who that user is.
Simple Definition:
A role is a reusable access label that groups related permissions.
Think of a role like a job badge in an organization.
People with an Editor badge may change documents. People with a Viewer badge may read them. The badge makes the access pattern easy to understand and manage.
Roles turn access policy into named, reusable groups that a system can apply consistently.
Collect related actions under one understandable name.
Give a user or service a role instead of many individual permissions.
Apply the same access rules to everyone with the same role.
Track role assignments and policy changes more clearly.
Roles are used wherever software needs repeatable access patterns for people, teams, or services.
Administrators can manage users, configuration, or organization settings.
Members can receive Viewer, Editor, or Manager access.
An API can use a role when deciding whether to accept an action.
A background service can receive only the role it needs.
User: Maya Role: Support Agent Permissions: - tickets.read - tickets.update - customers.read
Maya can view customer information and update support tickets. The role does not grant permission to delete users or change billing settings.
The role is the group name. The permissions are the individual actions inside that group.
Authentication establishes identity. Authorization uses roles and permissions to decide what that identity may do.
A named group of related access responsibilities or permissions.
One specific action or access rule, such as tickets.read.
The process of checking who a user or service is.
The decision about what an identified user or service may do.
Keep the order clear: authentication answers “Who are you?”; authorization uses roles and permissions to answer “What may you do?”
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| Role | 角色 | A named group of related access responsibilities. | 把一组相关访问权限打包在一起的名称。 |
| Permission | 权限 | A rule that allows a specific action or access. | 允许某个具体操作或访问某项资源的规则。 |
| Authorization | 授权 | The process of deciding what an identified user may do. | 判断已经确认身份的用户可以做什么。 |
| Authentication | 身份认证 | The process of checking who a user or service is. | 检查用户或服务到底是谁。 |
| Role Assignment | 角色分配 | Giving a user or service a role. | 把某个角色分配给用户或服务。 |
| Resource | 资源 | Something that a system protects or provides access to. | 系统需要保护或控制访问的东西，例如文件、订单或设置。 |
| RBAC | 基于角色的访问控制 | An access-control model that grants permissions through roles. | 通过角色来分配权限的一种访问控制方式。 |
A role is a reusable name for a group of related permissions.
Roles make access easier to assign, explain, review, and change.
Core idea:
Authentication identifies a caller. A role helps authorization decide which actions that caller may perform.