RBAC Explained: Roles, Permissions, Hierarchies, and Role Explosion

RBAC Explained: Roles, Permissions, Hierarchies, and Role Explosion

Role-Based Access Control (RBAC) grants permissions through roles instead of assigning every permission directly to every user.

flowchart LR
    U[Users] --> R[Roles]
    R --> P[Permissions]
    P --> X[Protected Actions / Resources]

Core Model

Example:

Viewer  → report.read
Manager → report.read + report.edit
Admin   → user.manage + billing.manage + ...

Users receive permissions by being assigned to one or more roles. NIST's RBAC model also supports role hierarchies and separation-of-duty constraints.

Role Hierarchy

A hierarchy can reduce duplication:

Admin
  ↑
Manager
  ↑
Viewer

A senior role can inherit lower-level permissions when that matches the organization's policy. Keep inheritance easy to audit; deep hierarchies can become confusing.

Separation of Duties

Some permissions should not belong to one person simultaneously—for example, creating and independently approving a sensitive financial action.

RBAC models can enforce static or session-level separation-of-duty constraints around incompatible roles.

Scope Roles Correctly

In SaaS applications, manager usually means:

manager within tenant/workspace X

not global manager across the platform.

Store role assignments with their scope and still verify object ownership/tenant boundaries during authorization.

Watch for Role Explosion

RBAC becomes awkward when teams create a new role for every combination of department, tenant, resource, region, and condition.

finance-manager-eu-project-a
finance-manager-eu-project-b
...

At that point, attributes or relationships may express the policy more cleanly. OWASP recommends considering ABAC/ReBAC for fine-grained object-level authorization.

Final Takeaway

RBAC is excellent when permissions map cleanly to stable organizational roles. Keep roles small, scoped, and auditable; use hierarchy carefully; enforce separation of duties; and move toward ABAC/ReBAC when role combinations start encoding resource context instead of job function.

References

• NIST Role-Based Access Control
• OWASP Authorization Cheat Sheet