RBAC
Role-based access control bundles entitlements into roles so access is granted by job function, not one permission at a time.
RBAC groups fine-grained entitlements into roles so people get access based on their job function. In IdentityIQ, business roles model job functions and contain IT roles, which bundle the actual entitlements in target systems. Assigning one business role provisions everything beneath it.
- RBAC grants access by role, not by individual permission
- Business roles model job functions
- IT roles bundle real entitlements in target systems
- Roles can be assigned automatically by identity attributes
- Good role design cuts access sprawl and review effort
Role-based access control (RBAC) is the model at the heart of SailPoint: instead of granting individual permissions, you group them into roles that map to job functions, then assign roles to people. RBAC is what makes access manageable, reviewable and provisionable at enterprise scale.
Why roles
Tracking thousands of individual entitlements per person is impossible to govern. Roles collapse that complexity into a few hundred business-meaningful units, so you reason about "Branch Teller" rather than the dozen entitlements a teller needs. Assign the role and its access follows; remove it and the access is revoked.
Business and technical roles
A common design nests two tiers: business roles model job functions and grant one or more IT/technical roles, which bundle the actual entitlements per application. This keeps the business view clean while managing technical detail underneath.
How roles are assigned
- Automatically, via membership criteria matching identity attributes.
- By request, from the access catalogue with approval.
- Manually, by an administrator.
RBAC with ABAC
The strongest designs combine RBAC with attribute-based rules: identity attributes automatically drive role assignment, giving you the auditability of roles with the dynamism of attributes.
Common pitfalls
- Over-broad roles that grant more than a job needs.
- Role explosion, so many narrow roles they are unmanageable.
- Unowned, unreviewed roles that drift over time.