Which model assigns access rights to roles, not individuals?

Which model assigns access rights to roles, not individuals?

• A. Access Control List (ACL)
• B. Capability List
• C. Role-Based Access Control (RBAC)
• D. Security Labels

Answer: (C)

Role-Based Access Control assigns access rights to roles, not to individuals. In this model, each role represents a job function with a defined set of permissions. Users gain access by being assigned to appropriate roles, and their access automatically follows those role memberships. This makes managing permissions scalable in large organizations and helps enforce least privilege as people move between responsibilities. For example, a “Finance Analyst” role might include read access to financial data, while a “Finance Manager” role adds approval rights; when someone changes roles, their access adjusts accordingly without rewriting each user’s permissions. Other models operate differently. Access Control Lists attach permissions to objects with explicit user (or group) lists, which can become unwieldy to maintain as the user base grows. Capability lists grant specific tokens to users for particular actions, tying rights directly to the user-holder rather than to a role. Security labels are used in mandatory access control to tag data and enforce restrictions by policy, not to map privileges to organizational roles.

Role-Based Access Control assigns access rights to roles, not to individuals. In this model, each role represents a job function with a defined set of permissions. Users gain access by being assigned to appropriate roles, and their access automatically follows those role memberships. This makes managing permissions scalable in large organizations and helps enforce least privilege as people move between responsibilities. For example, a “Finance Analyst” role might include read access to financial data, while a “Finance Manager” role adds approval rights; when someone changes roles, their access adjusts accordingly without rewriting each user’s permissions.

Other models operate differently. Access Control Lists attach permissions to objects with explicit user (or group) lists, which can become unwieldy to maintain as the user base grows. Capability lists grant specific tokens to users for particular actions, tying rights directly to the user-holder rather than to a role. Security labels are used in mandatory access control to tag data and enforce restrictions by policy, not to map privileges to organizational roles.