Role-Based Access Control

• Role-based access control is a method of ensuring only authorized personnel have access to sensitive system resources. Without a system like this in place, low-level employees could access financial information, reports and confidential memos. You would typically find role-based access control in companies with more than 500 employees. It offers a fast and simple way of organizing employees into tiers. Each tier above the last has more access to the company's network and databases.
  
  

Roles

• The process of implementing role-based access control begins with assigning each employee a role. You can create as many roles as you need, but each must have a unique name. Each role has a different level of access to the system, and you can change any given employee's role at any time. You must actively assign a role to each employee, but once you do so, the system will automatically restrict their movement throughout your company's network.
  
  

Terms

• There are many terms you will run into when implementing the RBAC. The first is "Subject." This is simply any employee that you have entered into the system, or any piece of software that runs on your network. The second is "Subject Assignment," and this is a subject's current role. Next, you have "Partially Ordered Role Hierarchy." This is a map of the role hierarchy within your RBAC system. Note that a single subject can have more than one role, and that a role can have an unlimited number of subjects assigned to it.
  
  

Permissions

• A permission is an action, or a set of actions, that someone assigned a given role is free to take. When you create a role, you specify the permissions immediately. This means that once you have created it, you will never again have to assign permissions on an individual basis because you assign people to that role as needed. This also means that you can easily track instances of people attempting actions for which they do not have permissions. Note that any given permission can be assigned to more than one role, and that a role can have an unlimited number of permissions.