# Co-author of the NIST RBAC model

Source: https://startwithidentity.com/experts/rick-kuhn/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Bio

Rick Kuhn co-authored the 1992 NIST paper on role-based access control with David Ferraiolo and has worked on the model, its formalization, and its assurance ever since, alongside research on combinatorial testing.

Profile built from public NIST and standards records.

## Where their work shows up

The testing side of this work matters more than it sounds. An access-control policy that cannot be verified is a policy nobody can safely change, which is why role explosion and stale entitlements outlive the people who created them. See [mover entitlement accumulation](https://startwithidentity.com/techniques/mover-entitlement-accumulation/), [RBAC to ReBAC](https://startwithidentity.com/guides/authorization/rbac-to-rebac/), and [what is IGA](https://startwithidentity.com/guides/fundamentals/what-is-iga/).