Role-based access control (RBAC) restricts what a user can do in your application based on the roles you assign. Each role references permissions. The user's access is the set of permissions on those roles.
Roles and permissions are part of the authorization model. After the user authenticates, the access token includes the user's roles and the permissions on those roles.
For example, a retail application can give buyers and partners different permissions, and a payments application can give partners access to data that customers do not receive.
- Manage permissions on roles instead of assigning them to each user. This reduces errors when access changes.
- Restrict each role to the access it needs, and adjust that access by updating the role.
- Give third-party users, such as vendors, a predefined role.
- Limit what each role can do, which supports confidentiality and privacy requirements.
A group is a collection of users. A role is a collection of permissions. Roles change less often than group membership, because they are organized around access rather than around who the user is.
Roles are created and assigned in the application. The same user can have a Partner role in one application and a Customer role in another. A user can have more than one role, and the same permission can belong to more than one role. The user's permissions are the union of the permissions on their roles in that application. The access token includes every permission on those roles, and every role assigned to the user.