Definition
Role-Based Access Control (RBAC) is an authorization model where permissions are assigned to roles, and users inherit permissions by being assigned to those roles.
In more depth
RBAC is the dominant enterprise authorization model. Permissions live on roles (e.g. "Finance Reader"), users get role assignments, and the union of role permissions determines what the user can do. RBAC scales well when roles map cleanly to job functions but struggles when access needs become highly contextual (e.g. "approve invoices from your own department but not others").
When RBAC stretches too far, programs evolve to ABAC (attribute-based) or ReBAC (relationship-based) for contextual decisions, often keeping RBAC as the coarse-grained shell.
Want the work, not just the definition?