# Co-author of the NIST RBAC model

Source: https://startwithidentity.com/experts/david-ferraiolo/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Bio

David Ferraiolo co-authored "Role-Based Access Controls" with Rick Kuhn, presented at the 15th National Computer Security Conference in October 1992. The NIST model that followed was adopted as ANSI INCITS 359 in 2004 and revised in 2012.

Profile built from public NIST and standards records.

## Where their work shows up

The 1992 paper argued that access decisions in organizations follow job function rather than individual discretion, and that systems should model it that way. Vendors including IBM, Sybase, Secure Computing, and Siemens shipped products on that model within a couple of years, and the ANSI standard gave procurement something to require. See [implementing RBAC in the enterprise](https://startwithidentity.com/guides/authorization/implementing-rbac-enterprise/) and the [best authorization tools](https://startwithidentity.com/rankings/best-authorization-tools/) ranking.