What is RBAC, and Why Should Data Infrastructure Teams Care?
Syed Mahmood
Role-Based Access Control’s (RBAC) primary objective is to provide a framework that enables enterprises to define and enforce access control policies for their data. These policies play a critical role in streamlining data security and governance. It is important to note that RBAC’s implementation in any enterprise is dictated by its own organizational policies. This provides RBAC the flexibility to be applicable to any organization. As the organizational data access policies evolve over time to meet new requirements or regulations, the controls implemented under RBAC can also be easily modified to reflect those changes.
RBAC is one of the primary approaches to managing access to enterprise data. It is based on the concept of users, roles, groups, and privileges in an organization. We explained these fundamental concepts in the first blog of the series.
In the RBAC framework, access to data is associated with roles. Users or subjects are associated with organizational roles. Users can be assigned roles based on their responsibilities or qualifications in the organization. Administrators then assign privileges or permissions to the roles. RBAC simplifies the administration of data access controls because concepts such as users and roles are well-understood constructs in a majority of organizations.
Another advantage of RBAC is the framework’s flexibility in enabling administrators to assign users to various roles, reassign users from one role to another, and grant new permissions or revoke permissions as required. Once an RBAC framework is established, the administrator’s role is to primarily assign or revoke users to specific roles.
Get Syed Mahmood’s stories in your inbox
Join Medium for free to get updates from this writer.
As mentioned above, RBAC’s framework revolves around the concepts of users, roles, and operations. The relationship between users, roles, and operations is represented in the figure below.
Source: Role-Based Access Control (RBAC): Features and Motivations
There is a many-to-many relationship between users, roles, and operations. This means that a user can be assigned many roles, a role can have many users, and a role or a user can perform many operations. For example, Fiona, who is a financial analyst in an insurance company, is also part of the company’s audit committee and is an administrator of the finance department’s data mart. Essentially, Fiona has three roles: financial analyst, member of the audit committee, and database administrator. In addition to Fiona, the company’s audit committee consists of several members. These members include John and Michelle. A single role can also have multiple users — in this case, Fiona, John, and Michelle. A role can be granted permission to perform one or more operations. In this case, members of the audit committee may be able to insert, append, or update data in the finance data mart, whereas a user who is not a part of the audit committee will not have these privileges.
The core RBAC model can be extended by introducing the concept of role hierarchies. This means that a role may be defined in relation to one or more roles. A role hierarchy defines roles that have unique characteristics and that may “contain” other roles. This means that one role may include the permissions, constraints, and objects that are associated with another role. In other words, RBAC accommodates the concept of the parent-child relationship between roles. For example, in the figure below, Role A has access to tables 1 and 3, whereas Role B has access to tables 2 and 4. In this case, Role A contains Role B. Based on this definition, the users that have been assigned Role A will also have access to tables 2 and 4, even though they don’t have explicit permission to access data in those tables.
Source: A Revised Model for Role-Based Access Control
In RBAC, administrators also have the ability to define nested relationships — where one role can contain other roles, which in turn, contain other roles.
Stay tuned for the next blog in the series, in which we will cover the concept of role-based access control (RBAC) in-depth. Contact Privacera today to learn more about RBAC, ask our team questions, or schedule a demo.
