Role-based access control (RBAC) is an access control model that assigns permissions to roles rather than to individuals, then places users into the roles that match their jobs. A “Finance Analyst” role carries a defined set of rights, and everyone holding that role inherits exactly those rights.
The model scales because administrators maintain a manageable number of roles instead of permissions for thousands of separate accounts. When a person changes jobs, you swap their role rather than editing dozens of individual grants, which cuts errors and makes audits far cleaner. The risk is role explosion, where an organization creates so many narrow roles that the model grows as tangled as the per-user chaos it was meant to replace. Well-designed roles track genuine job functions and get reviewed on a regular schedule.
How is RBAC tested on the CISSP?
RBAC is a core topic in Domain 5, Identity and Access Management. Be ready to contrast it with discretionary, mandatory, and attribute-based control, and to pick the model that fits a scenario. Know its building blocks: users, roles, permissions, and sessions. Study Domain 5: Identity and Access Management.
The foundational work is described in NIST RBAC standards.