# rbac

Source: https://startwithidentity.com/glossary/rbac/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Role-Based Access Control. Permissions are bundled into roles, users are assigned roles. Simple to understand and audit, but role explosion is a common failure mode at scale. Almost every modern access model starts with RBAC and adds finer-grained controls on top.

RBAC's strength is that a human can read an assignment and understand it, which is why auditors like it and why it will not go away. Role explosion is the standard failure: every exception becomes a new role until there are more roles than users. The workable pattern is a small set of coarse roles for the bulk grant, with attributes or relationships handling the conditions that would otherwise multiply roles.

See also: [RBAC vs ABAC vs ReBAC](https://startwithidentity.com/guides/fundamentals/rbac-vs-abac-vs-rebac/), [ABAC](https://startwithidentity.com/glossary/abac/), [role mining](https://startwithidentity.com/glossary/role-mining/), [entitlement](https://startwithidentity.com/glossary/entitlement/)