RBAC

Role-Based Access Control

Permissions assigned via roles, not individuals.

When you'd see it: Almost every system with user permissions. "What's your role?" maps directly to what you are allowed to do.

Why it matters: RBAC attaches permissions to roles and roles to people, so access is managed in groups instead of one person at a time. It is the default access model because it scales and audits cleanly.

Common mistakes: Letting roles multiply until nearly everyone has a custom role. At that point RBAC has quietly become per-user permissions with extra steps.