Role-based access control (RBAC)

Role-based access control, RBAC, grants permissions based on a user's assigned role, such as "analyst," "finance viewer," or "admin," rather than configuring access individually for each person. A role bundles a set of permissions once; adding a new employee to a role grants them everything that role allows, and removing them revokes it all at once.

RBAC controls access at the level of objects: which tables, dashboards, or systems a role can see at all. It differs from row-level security, which is finer-grained and restricts which rows within a table a user can see, rather than access to the table itself; the two are frequently used together, RBAC to grant table access and row-level security to restrict it further. It's also distinct from, but often driven by, data classification, which flags which fields are sensitive enough to need restriction in the first place.

RBAC matters because managing access per individual doesn't scale and tends to drift, people accumulate permissions from old roles and rarely lose them. It's a standard control reviewed under data governance and is often required to demonstrate that access to personally identifiable information is limited to those who need it, along with visibility into who holds which role via a data catalog. The common pitfall is "role sprawl," where roles multiply and overlap until the system is effectively back to unmanaged per-user permissions.