Управление доступом на основе ролей (RBAC)

Technical explanation

RBAC separates users, roles, permissions, sessions, and constraints. Role hierarchies can inherit permissions, while separation-of-duty rules prevent conflicting assignments or activations. Roles should reflect stable job responsibilities and be governed through approval and review.

Business relevance

RBAC simplifies permission administration at scale, supports least privilege, and provides an auditable connection between job responsibilities and system access.

Implementation example

A finance-analyst role can view invoices and reports, while a payment-approver role can authorise payments. Separation-of-duty rules prevent one user from holding both capabilities without exception approval.

Limitations and common misconceptions

Poor role design causes role explosion or excessive access. RBAC handles contextual and fine-grained decisions less naturally than attribute-based approaches and still requires lifecycle management and access reviews.

Темы

Sources