Role-based Access Control (RBAC)

The 4 models of RBAC are as follows:

• Core RBAC
• Hierarchical RBAC
• Constrained RBAC
• Symmetric RBAC

The National Institute of Standards and Technology (NIST), which developed the RBAC model, provides three basic rules for all RBAC systems.

Role assignment: A user must be assigned one or more active roles to exercise permissions or privileges.

Role authorization: The user must be authorized to take on the role or roles they have been assigned.

Permission authorization: Permissions or privileges are granted only to users who have been authorized through their role assignments.

Role-based access control (RBAC) and attribute-based access control (ABAC) are two different approaches to authorize users to access certain resources. While RBAC is a role-based mechanism, where users are assigned certain roles with specific privileges that allow or deny users access to certain resources, ABAC uses attributes for the same. RBAC is simple and flexible, while ABAC provides more control over permissions.