What is RBAC (role-based access control)?

In practice

Good role design starts from the process, not the org chart. The questions that matter are who may see a record before it is assigned, who may reassign it, who may approve, and what a person sees when the answer is no. Systems that hide the existence of a record behave very differently from systems that show it and refuse access, and the choice is a business one.

Where it fits in a build

Any system where more than one role touches the same record: case management, tender operations, claims, support, recruitment. Wherever the answer to "who can see this?" is not everyone.

Common mistakes

• Checking permissions in the interface only, leaving the API open to anyone who looks.
• Roles that accumulate permissions over time until everyone is effectively an administrator.
• No record of permission changes, so nobody can answer who granted access and when.

Related terms

• Least privilege
• Audit trail
• Single sign-on (SSO)

Working on something that involves this?

ASTACKRA designs and builds AI systems, automation and custom software for businesses that need technology shaped around their own workflow. If this term turned up in a proposal and you want a straight answer about whether it applies to your situation, ask us — no obligation, and we will tell you if the answer is no.