RBAC
Quick answer
RBAC groups fine-grained entitlements into roles so people get access based on their job function. In IdentityIQ, business roles model job functions and contain IT roles, which bundle the actual entitlements in target systems. Assigning one business role provisions everything beneath it.
Key takeaways
- RBAC grants access by role, not by individual permission
- Business roles model job functions
- IT roles bundle real entitlements in target systems
- Roles can be assigned automatically by identity attributes
- Good role design cuts access sprawl and review effort
Role-based access control (RBAC) is the model at the heart of SailPoint: instead of granting individual permissions, you group them into roles that map to job functions, then assign roles to people. RBAC is what makes access manageable, reviewable and provisionable at enterprise scale.
Why roles
Tracking thousands of individual entitlements per person is impossible to govern. Roles collapse that complexity into a few hundred business-meaningful units, so you reason about "Branch Teller" rather than the dozen entitlements a teller needs. Assign the role and its access follows; remove it and the access is revoked.
Business and technical roles
A common design nests two tiers: business roles model job functions and grant one or more IT/technical roles, which bundle the actual entitlements per application. This keeps the business view clean while managing technical detail underneath.
How roles are assigned
- Automatically, via membership criteria matching identity attributes.
- By request, from the access catalogue with approval.
- Manually, by an administrator.
RBAC with ABAC
The strongest designs combine RBAC with attribute-based rules: identity attributes automatically drive role assignment, giving you the auditability of roles with the dynamism of attributes.
Common pitfalls
- Over-broad roles that grant more than a job needs.
- Role explosion, so many narrow roles they are unmanageable.
- Unowned, unreviewed roles that drift over time.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
RBAC grants access based on?
- A. Job function (role). RBAC assigns access by role rather than one entitlement at a time.
- B. Business role. Business roles model job functions and contain IT roles.
- C. Birthright roles. Assignment rules grant birthright roles based on attributes.
Show answer
A. Job function (role). RBAC assigns access by role rather than one entitlement at a time.
Job function (role). RBAC assigns access by role rather than one entitlement at a time.
A role that reflects a job function is a?
- A. Business role. Business roles model job functions and contain IT roles.
- B. Birthright roles. Assignment rules grant birthright roles based on attributes.
- C. Job function (role). RBAC assigns access by role rather than one entitlement at a time.
Show answer
A. Business role. Business roles model job functions and contain IT roles.
Business role. Business roles model job functions and contain IT roles.
Roles assigned automatically from identity attributes are?
- A. Birthright roles. Assignment rules grant birthright roles based on attributes.
- B. Job function (role). RBAC assigns access by role rather than one entitlement at a time.
- C. Business role. Business roles model job functions and contain IT roles.
Show answer
A. Birthright roles. Assignment rules grant birthright roles based on attributes.
Birthright roles. Assignment rules grant birthright roles based on attributes.