RBAC (Role-Based Access Control)

Assigning permissions to individual users one at a time doesn't scale: a thousand-person organization would need a thousand separately maintained permission sets, and every access change would mean editing a specific person's record. Role-based access control fixes that by putting a layer of indirection between people and permissions: permissions attach to roles, and people are assigned to roles.

Changing what a "moderator" can do updates every moderator at once; changing who is a moderator is a one-line membership edit, not a rewrite of that person's entire permission set. Role bundles can also compose — an "admin" role might inherit everything a "member" role can do, plus more — which keeps the permission model legible even as it grows.

RBAC's limitation shows up with relationships that are specific to a pairing rather than a broad category — "this person can see this one client's data" doesn't fit neatly into a role someone either has or doesn't. That's usually where a system pairs RBAC with relationship-based access control (ReBAC) for the fine-grained cases roles handle awkwardly.