* [Topics](/en/topics "Topics") * [Security](/en/topics/security "Security") * What is access control? What is access control? ======================= Published December 23, 2024•*6*-minute read Copy URL Jump to section --------------- What is access control?Types of access controlsWhat are Access Control Lists?How are ACLs and RBACs different?Why use automation with access control?Why Red Hat? What is access control—and why is it important? ----------------------------------------------- Access control is a security authorization technique that determines what specific resources a user or system can view or engage with in an IT infrastructure. It's an essential component of [cybersecurity](/en/topics/security) with the basic goal of protecting sensitive information against unauthorized access. Access control is established by identifying the legitimacy of a user or system’s credentials, then granting the identity an appropriate level of access based on their role or degree of clearance. Several mechanisms including real-time monitoring, compliance, and review ensure that access control systems can improve organizational security measures and reduce threats. [Explore security automation use cases](/en/technologies/management/ansible/security-automation) Types of access controls ------------------------ There are 6 common types of access control models. Here’s how each manages user permissions: ### Role-based Access Control (RBAC) This model grants or denies access to users **based on their assigned roles and responsibilities.** These roles determine what resources users can access and system administrators can directly manage access rights based on user-assigned roles. RBAC supports role hierarchies and higher-level roles can also inherit access permissions from lower-level roles, helping to simplify management. For example, a user in a “Staff” role may have limited permissions such as read only or file sharing access whereas a "Manager" will have all the permissions of a “Staff” user plus additional access rights. RBAC follows the principle of least privilege (PoLP), a foundation of [Zero Trust](/en/topics/security/what-is-zero-trust)security. ### Rule-based Access Control (RuBAC) In this model, access is granted or denied **based on a set of predetermined rules** that involves individual user criteria or conditions. Implementation includes identifying user-specific needs, creating [identity and access management (IAM)](/en/topics/security/what-identity-and-access-management-iam) policies that define the rules for these needs, and applying conditions to enhance security. Rules are typically based on conditions such as time of access, IP address, and multi-factor authentication. For example, access may be granted only during business hours, if the user is securely logged into a Virtual Private Network (VPN), or in on-premise applications only. ### Mandatory Access Control (MAC) This security technique enforces access restrictions **based on fixed mandatory policies and rules set by system admins** where permissions can’t be modified by users. Disabling user access modifications ensures that sensitive information is protected according to non-negotiable security protocols. In this system, each user is assigned a predetermined security level and resources are classified by its level of sensitivity. Access is granted or denied depending on whether a user’s security level matches or surpasses the resource’s classification level. MAC should not be mistaken as a joint role-based and rule-based access control. Though enforcing mandatory rules is its core function, MAC does not allow users to control access permissions—no matter their security level—and security levels are not determined by user roles. MAC can, however, be integrated with RBAC concepts in certain [data security](/en/topics/automation/what-is-security-automation) systems. ### Discretionary Access Control (DAC) This flexible resource security management system **assigns or revokes user access at the resource owner’s discretion.** When a user creates or uploads files to their personal cloud, the user can specify permissions for each file, determining whether it is accessible to  the public, to specific users, or privatized solely for the owner’s use. This type of access control is common in file systems and the resource owner can update permissions or remove user access at any time. ### Attribute-based Access Control (ABAC) ABAC is **based on user, resource, and environment attributes** and evaluates these multiple characteristics simultaneously. For example, when a user provides credentials to log into a cloud service, the system will retrieve the user’s attributes—such as their roles or permissions—from their profile. Then, it will identify the resource attributes such as file type, ownership, and sensitivity with contextual attributes such as time of access, user location, and if the user is requesting access on a secure network. The system will then evaluate whether the combined attributes meet the security policies and make a decision to grant or deny access. ### Access Control Lists (ACL) ACL is a **list that defines user or system permissions and the actions they’re allowed to perform** once a resource is accessed. This list is typically created and managed by system admins but some automated systems can generate ACLs based on predetermined rules or policies.  Whether you need one or multiple access control systems, they are an essential and necessary component for your IT infrastructure. Evaluate your security and [compliance](/en/topics/management/what-is-compliance-management) needs to decide which access control model is most appropriate for your organization. [Simplify your security operations center](/en/engage/security-automation-ebook) Why choose Red Hat for DevSecOps -------------------------------- [Read the article](/en/topics/devops/why-choose-red-hat-for-devsecops "Read the article") What are Access Control Lists—and how do they work? --------------------------------------------------- An access control list (ACL) is a set of rules that specifies which user or entity can or cannot access a particular file or resource in a computer environment. More specifically, ACLs act as filters associated with system resources. For example, when a user attempts to access a resource, the system will check the ACL linked to that resource and compare the user’s identity with the contents listed in the ACL. If the system finds a matching record, the user is granted entry with specified permissions. If no match exists, access is denied. Similar to firewalls, ACLs are rule-based and operate on predefined criteria to evaluate access requests. However, while ACLs specify user permissions, firewalls establish the rules for approving or denying network traffic.  There are two types of ACLs: **Filesystem ACLs:** This method defines and manages content and directories within a filesystem and filters access to the files. Based on predefined rules, a filesystem ACL tells operating systems which users can gain access and the privileges they have inside the system. **Networking ACLs:** This method filters access in network devices such as routers, switches, and firewalls, and manages security by specifying which traffic can access the network and the activities allowed once inside. This fundamental security feature can be placed on any security or routing device to simplify how users or systems are identified and manage how they interact with sensitive information. How are ACLs and RBACs different? --------------------------------- Though they are both methods of managing resources, ACLs and RBACs operate differently. ACLs control permissions for individual users at low-levels of data security whereas RBAC systems control security at the organizational level with overseeing admins. While RBACs offer a broader approach to simplifying security management based on user roles, ACLs allow more granular rules to be tailored to individual users on a per-resource basis without affecting user roles. RBAC is ideal for organizations with defined roles. It can best serve as a company-wide security system with the help of a monitoring administrator. ACL works best for detailed control over individual resources and offers the flexibility to manage access easily. Choosing either greatly depends on your organization’s structural and security requirements such as compliance and regulation audits. Potential audits include identifying how many users or unauthorized traffic has system admin access. Having resource management makes it easier for you to analyze and review data security to ensure your organization remains compliant. [Learn more about role-based access control](/en/engage/security-automation-ebook) Why use automation with access control? --------------------------------------- Without [IT automation](/en/topics/automation/what-is-it-automation), organizations are forced to work manually, increasing production time, operational costs, and security vulnerabilities including unauthorized access. Automation reduces human error by simplifying routine tasks such as user provisioning, system updates, access reviews, and audit generation at speed that would be otherwise challenging if done manually. As companies grow, automation helps to manage increased data and users, strengthening security by enabling real-time detection and threat response. Implementing automated [patch management](/en/topics/management/what-patch-management-and-automation) and [Security Information and Event Management (SIEM)](/en/topics/management/what-patch-management-and-automation) with access control can minimize human errors in IT security processes and improve compliance. Patch management solutions can be paired with automation software to fix known vulnerabilities in systems or applications that enforce access control policies. On the other hand, SIEM automation detects anomalies by analyzing access patterns in real-time and can automatically alert security teams when an event occurs. SIEM also automates audit logs, and tracks and stores access activities for compliance purposes. By supplementing access control with automation, businesses can effectively enforce least-privilege access policies while ensuring that access aligns with organizational needs. [IT executive’s guide to automation](/en/resources/executive-guide-to-automation-ebook) Network automation for everyone ------------------------------- [Keep reading](/en/engage/network-automation-everyone-s-202101221234 "Keep reading") Why choose Red Hat Ansible Automation Platform? ----------------------------------------------- [Red Hat® Ansible® Automation Platform](/en/technologies/management/ansible) helps you automate manual tasks and speed up time-to-value while facilitating automation at the scale, complexity, and flexibility required of the modern enterprise. As the control plane of Ansible Automation Platform, [automation controller](/en/technologies/management/ansible/automation-controller) allows administrators to define, operate, and delegate automation across teams. It provides granular, [built-in RBAC capabilities](https://aap2.demoredhat.com/exercises/ansible_network/8-controller-rbac/) and integrates with [enterprise authentication systems](https://docs.ansible.com/automation-controller/latest/html/administration/ent_auth.html) to ensure that automation meets security and compliance standards. Security operations teams can also use Ansible Automation Platform to manage other enterprise applications, like [SOAR](/en/topics/security/what-is-soar) solutions. If you’re looking to bring improved security, compliance, and operational efficiency to IAM in container orchestration, [Red Hat OpenShift®](/en/technologies/cloud-computing/openshift) can help you manage user access to pods, nodes, and entire clusters. An enterprise-ready hybrid cloud application platform, Red Hat OpenShift allows you to manage, deploy, and scale containerized applications while taking advantage of powerful Kubernetes components—including security features like [Kubernetes RBAC](/en/topics/containers/what-kubernetes-role-based-access-control-rbac). [Get started in automation controller](/en/technologies/management/ansible/automation-controller) Resource The automated enterprise ------------------------ Read this e-book to unlock the power of automation to revolutionize IT services like network, infrastructure, security, DevOps, and edge. [Get the resource](/en/resources/automated-enterprise-e-book "The automated enterprise") Red Hat Ansible Automation Platform training and certification -------------------------------------------------------------- Explore Red Hat Ansible Automation Platform training courses and certification exams—and find the skills path that’s best for your role. [Keep reading](/en/technologies/management/ansible/training-and-certification "Red Hat Ansible Automation Platform training and certification") Keep reading ------------ ### What is confidential computing? Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it. [Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?") ### What are SPIFFE and SPIRE? SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems. [Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?") ### Red Hat Enterprise Linux security Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy. [Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security") Security resources ------------------ ### Featured product * #### [Red Hat Ansible Automation Platform](/en/technologies/management/ansible) A platform for implementing enterprise-wide automation, no matter where you are in your automation journey. [See all products](/en/technologies/all-products "See all products") ### Related content * Blog post [A 5-step playbook for unified automation and AI](/en/blog/5-step-playbook-unified-automation-and-ai) * Blog post [CIS Benchmark for Red Hat OpenShift Virtualization: Secure your hybrid cloud](/en/blog/cis-publishes-hardening-guidance-red-hat-openshift-virtualization) * Blog post [Red Hat OpenShift sandboxed containers 1.11 and Red Hat build of Trustee 1.0 accelerate confidential computing across the hybrid cloud](/en/blog/red-hat-openshift-sandboxed-containers-111-and-red-hat-build-trustee-10-accelerate-confidential-computing-across-hybrid-cloud) * Blog post [Solving tool overload, one automation step at a time](/en/blog/solving-tool-overload-one-automation-step-time) ### Related articles * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is DevOps automation?](/en/topics/automation/what-is-devops-automation) * [What is IT service management (ITSM)?](/en/topics/automation/what-is-it-service-management-itsm) * [What is Infrastructure as Code (IaC)?](/en/topics/automation/what-is-infrastructure-as-code-iac) * [Ansible vs. Kubernetes: how they work together](/en/topics/automation/Ansible-vs-Kubernetes) * [What is a configuration management database (CMDB)?](/en/topics/automation/what-is-a-configuration-management-database-cmdb) * [What is cloud migration? And how can automation help?](/en/topics/automation/what-is-cloud-migration) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is a software-defined data center (SDDC)?](/en/topics/automation/what-is-a-sddc) * [What is IT automation?](/en/topics/automation/what-is-it-automation) * [Why choose Red Hat Ansible Automation Platform as your AI foundation?](/en/topics/automation/automation-and-ai) * [How to build an IT automation strategy](/en/topics/automation/build-an-automation-strategy) * [What is virtual infrastructure management? And how can automation help?](/en/topics/automation/virtual-infrastructure-management) * [What is IT migration?](/en/topics/automation/what-is-it-migration) * [How to automate migrations with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/automate-migrations-with-red-hat-ansible-automation-platform) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [What is a CVE?](/en/topics/security/what-is-cve) * [What is CloudOps?](/en/topics/automation/what-is-cloudops) * [Red Hat Satellite on Red Hat Enterprise Linux](/en/technologies/management/satellite/satellite-for-rhel) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Which Red Hat Ansible Automation Platform deployment option is right for you?](/en/technologies/management/ansible/ansible-deployment-options) * [What is an Ansible module—and how does it work?](/en/topics/automation/what-is-an-ansible-module) * [How to manage and automate applications at the edge](/en/topics/edge-computing/how-to-manage-automate-applications-edge) * [How to build an automation Center of Excellence](/en/topics/automation/how-to-build-automation-center-of-excellence) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [What is orchestration?](/en/topics/automation/what-is-orchestration) * [How to adopt Automation as Code: Extending Infrastructure as Code into Policy as Code](/en/topics/automation/how-to-adopt-automation-as-code) * [What is a webhook?](/en/topics/automation/what-is-a-webhook) * [Learning Ansible basics](/en/topics/automation/learning-ansible-tutorial) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is an Ansible Role—and how is it used?](/en/topics/automation/what-is-an-ansible-role) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [What is data management?](/en/topics/data-services/what-is-data-management) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is NetOps?](/en/topics/automation/what-is-netops) * [What is an Ansible Rulebook?](/en/topics/automation/what-is-an-ansible-rulebook) * [What is an Ansible Playbook?](/en/topics/automation/what-is-an-ansible-playbook) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is configuration management](/en/topics/automation/what-is-configuration-management) * [What is event-driven automation?](/en/topics/automation/what-is-event-driven-automation) * [Zero-Touch Provisioning and telco automation with Red Hat](/en/topics/telecommunications/zero-touch-provisioning-and-telco-automation-at-red-hat) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is infrastructure automation?](/en/topics/automation/what-is-infrastructure-automation) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is YAML?](/en/topics/automation/what-is-yaml) * [What is provisioning?](/en/topics/automation/what-is-provisioning) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Understanding Ansible, Terraform, Puppet, Chef, and Salt](/en/topics/automation/understanding-ansible-vs-terraform-puppet-chef-and-salt) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud orchestration?](/en/topics/automation/what-is-cloud-orchestration) * [Ansible vs. Chef: What you need to know](/en/topics/automation/ansible-vs-chef) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [Ansible vs. Salt: What you need to know](/en/topics/automation/ansible-vs-salt) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [What is a configuration file?](/en/topics/linux/what-configuration-file) * [Ansible vs. Puppet: What you need to know](/en/topics/automation/ansible-vs-puppet) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [Ansible vs. Terraform, clarified](/en/topics/automation/ansible-vs-terraform) * [Why choose Red Hat for automation?](/en/topics/automation/why-choose-red-hat-for-automation) * [Ansible vs. Red Hat Ansible Automation Platform](/en/technologies/management/ansible/ansible-vs-red-hat-ansible-automation-platform) * [What is cloud automation?](/en/topics/automation/what-is-cloud-automation) * [What is network automation?](/en/topics/automation/what-is-network-automation) * [What are managed IT services?](/en/topics/cloud-computing/what-are-managed-it-services) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [What is business process management?](/en/topics/automation/what-is-business-process-management) * [What is patch management (and automation)?](/en/topics/management/what-patch-management-and-automation) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security) * [What is the Red Hat Ansible Automation Platform automation controller?](/en/technologies/management/ansible/automation-controller-product-feature) * [What is SOAR?](/en/topics/security/what-is-soar) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [What is business process automation?](/en/topics/automation/what-is-business-process-automation) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [What is IT process automation?](/en/topics/automation/what-is-it-process-automation) * [Automating Microsoft Windows with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/automate-microsoft-windows-with-ansible) * [What is deployment automation?](/en/topics/automation/what-is-deployment-automation) * [What is business optimization?](/en/topics/automation/business-optimization) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is SRE?](/en/topics/devops/what-is-sre) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is API security?](/en/topics/security/api-security) * [What is robotic process automation (RPA?)](/en/topics/automation/what-is-robotic-process-automation) * [What is network management?](/en/topics/management/what-is-network-management) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is an SOE?](/en/topics/management/what-is-an-soe) * [What is IT system life-cycle management?](/en/topics/management/it-system-life-cycle-management) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) * [What is cloud management?](/en/topics/cloud-computing/what-is-cloud-management) * [What's business automation?](/en/topics/automation/whats-business-automation) [More about this topic](/en/topics/security "More about this topic")