Role-based access control
Role-based access control (RBAC) is an authorization model that groups permissions into roles and grants access by assigning those roles to users or other principals.
A role groups permissions
Instead of assigning every permission separately to every person, an organization defines roles and assigns people to them. NIST’s RBAC model describes that relationship between users, roles, and permitted operations.
The implementation still matters. Azure RBAC, for example, combines a security principal, a role definition, and a scope in a role assignment. The principal can be a user, group, service principal, or managed identity. Scope limits where the assignment applies.
A role called “Reader” or “Administrator” is only a label until you inspect its permissions and scope. Also check other assignments: a narrow role does not cancel broader access granted elsewhere.
Permission does not approve every use
RBAC can let a support administrator change an account. It does not establish whether a particular caller deserves that change. The business verification and approval procedure still has work to do.
Least privilege guides how much access to grant; RBAC is one way to organize and enforce it. A role with excessive permissions can violate least privilege even when the software enforces that role correctly.
Just-in-time access adds a time limit or activation step to access. RBAC describes the permissions attached to a role; it does not, by itself, make the assignment temporary. The privileged role activation article follows that separate decision.