Role-based access control (RBAC)
Role-based access control grants permissions based on a role a person holds, rather than assigning access to each person individually.
Category
Governance
See all terms
What is role-based access control?
Role-based access control (RBAC) grants permissions based on a role a person holds rather than assigning permissions to that person directly. Instead of deciding, one by one, what a new hire in sales can access, an administrator assigns them the "Sales" role, and that role carries whatever permissions the company decided sales should have.
This solves a scaling problem: managing permissions one person at a time works for small teams but breaks down quickly, since every hire, promotion, and departure means manually re-checking access. RBAC moves that decision to the role level, so a person's access changes automatically the moment their role does.
How RBAC differs from permissions on individual users and groups
Assigning permissions directly to an individual works but doesn't scale: every person needs their own configuration, with nothing shared or reused between them. RBAC organizes access around roles instead, but most systems, including Qontext, also support permissions for groups, sets of people who share access without necessarily sharing a formal role. A role tends to map to a job function company-wide, while a group can be scoped more narrowly, a single project or a temporary set of collaborators, without redefining what that role means everywhere else.
How does role-based access control work?
A role-based access control system defines a set of roles, assigns permissions to each role, and then assigns people to one or more roles. When someone's role changes, their access changes with it automatically, without having to update every permission individually.
Qontext applies the same underlying idea through user permissions, groups, and access controls for clients: an agent or a person only reaches what their assigned access allows, whether they're reading a single file on the platform or connecting through an API key.