Glossary
Role-Based Access Control (RBAC)
Role-based access control groups permissions into named roles — 'billing administrator,' 'read-only auditor' — and grants access by assigning a principal to a role, rather than listing individual permissions per identity. This scales well when the set of roles is stable and reasonably small: adding a new employee to a role is simpler than reconstructing their exact permission set from scratch.
It scales poorly when real needs don't map cleanly onto a fixed set of roles, which pushes teams toward creating more and more narrow, one-off roles, or toward granting a broader role than a person actually needs because the precisely right one doesn't exist yet.