Home › Identity & Access Management
Role-Based Access Control (RBAC) Explained — Access Control Models (Part 4)
Identity & Access ManagementCISSPSecurity+
Role-Based Access Control (RBAC) is a nondiscretionary access control model where access is granted through a subject's job role — assigned centrally by administrators, not by data owners. This is Part 4 of our Access Control Models series.
What you will learn
- Why RBAC is classified as a nondiscretionary access control model, administered centrally
- How permissions attach to roles — and how users inherit access by role membership (instant provisioning, one-step revocation)
- Static vs. Dynamic Separation of Duties (SoD), and how they force collusion to prevent fraud
- Role hierarchies and permission inheritance
- The NIST RBAC model levels (Core, Hierarchical, Constrained, Symmetric) and the Non → Limited → Hybrid → Full maturity path
- DAC vs. RBAC — the "who decides" trap (owner vs. administrator)
- RBAC vs. Rule-Based (RuBAC) — the #1 exam gotcha
- Why RBAC is the best fit for high-turnover organizations