What is RBAC?
Role-Based Access Control, told as a story about hats and key rings.
Every door had a list of names.A new person means fixing twenty lists.
People who left stay on the list.Forget one list, and a cook who quit can still open the kitchen.
RBAC gives each hat its own key ring.Keys hang on the hat, not the person. People just get a hat.
When people change, only the hat moves.Twenty doors untouched. Move one hat, done.
The hats keep multiplying.'Cook, but only at night', 'only while guests are in'… make a hat for each and you have a hundred. Conditions like that need another method (ABAC). And keys get added to hats far more often than removed.
RBAC = keys go on the hat (role), not the person; people just wear a hat.
Role-Based Access Control. Written up by Ferraiolo and Kuhn at NIST in 1992; most company systems work this way. It's how 'one key, one room' (least privilege) gets built in practice.
When grown-ups say it
- Role
- The hat. A name for a job — cook, clerk, guest — never a person's name.
- Permission
- One key. One single thing, like "open the kitchen door".
- Assignment
- Handing out a hat. Linking a person to a hat — and unlinking them.
- Least privilege
- Only the keys you need. The "one key, one room" from the castle that always asks.
- Role explosion
- A hundred hats. Make a hat for every condition and nobody can keep track.
- Privilege creep
- The hat that keeps getting heavier. Adding keys is easy; nobody ever takes one off.
- ABAC
- Conditions instead of hats. Opens doors by sentences like "is a cook, it's daytime, no guests inside".
- Access review
- Hat inspection day. Every quarter, check who's wearing which hat.