* [Topics](/en/topics "Topics")
* [Security](/en/topics/security "Security")
* What is role-based access control (RBAC)?
What is role-based access control (RBAC)?
=========================================
Published  May 14, 2024•*4*-minute read
Copy URL
Jump to section
---------------
OverviewHow does RBAC work?Benefits of RBACHow can automation help?How can Red Hat help?
Overview
--------
Role-based access control (RBAC) is a method of managing user access to systems, networks, or resources based on their role within a team or a larger organization.
An alternative to configuring specific system or network access for each individual user, RBAC allows IT administrators to identify the necessary level of access for all users with a particular job function and assign those users a role with the appropriately configured set of permissions. This gives IT teams the ability to easily add, modify, and remove permissions for all users in a group at once, or quickly change a single user’s access level by assigning or removing a role.
How does role-based access control work?
----------------------------------------
At its core, every role-based access control system follows the same basic principles:
* Each user is assigned one or more roles.
* User roles are assigned permissions.
* Users gain access to permissions by being active members of a role.
In many cases, RBAC models establish a role hierarchy, in which the role structure resembles the hierarchy of the organization and may include roles for administrators, end users, and guests, and any specialized group in between. Some role hierarchies may be inheritance hierarchies, where more senior user roles are automatically granted the roles beneath them along with their privileges. In other cases, the hierarchy may be arbitrary and users granted a senior role do not necessarily inherit descendent roles by default.
Depending on the use case, organizations using RBAC may also enforce separation of duties by requiring involvement from multiple users with different roles to initiate a specific task or action. This practice, along with regular auditing of role permissions, is implemented to reduce risk by ensuring that no single user has more privileges than they actually need.
Recommended for you
Red Hat Ansible Automation Platform for IBM Z & LinuxONE
--------------------------------------------------------
[Watch the webinar](https://www.redhat.com/en/events/webinar/aap-tech-journey-ibm-z-linuxone-2025?percmp=RHCTG0250000455235)
Benefits of role-based access control
-------------------------------------
RBAC is one of the most common types of [access control](/en/topics/security/what-is-access-control). It provides a more granular approach to [identity and access management (IAM)](/en/topics/security/what-identity-and-access-management-iam) than access control lists (ACLs), but remains simpler and easier to implement than attribute-based access control (ABAC). While other methods of IAM—like mandatory access control (MAC) or discretionary access control (DAC)—might be effective for specific use cases, RBAC is a good choice for most organizations looking for an easy-to-manage governance solution that scales.
**Increased operational efficiency and less down time**
RBAC makes the assignment of permissions consistent and repeatable, which can increase efficiency for operations teams that would otherwise need to configure individual user access or object permissions. If a team decides that users assigned to a role need access to a new resource, they only need to adjust permissions for the relevant role instead of configuring permissions for each person. Additionally, when a team member takes on a new job duty or responsibility, their permissions can easily be updated by changing their role or assigning a new one.
**Scalability**
Since roles are tied to the organizational structure, it’s an effective approach to IAM for teams of any size. Organizations undergoing rapid growth or transformation will find that roles can be assigned, removed, or modified quickly, ensuring minimal disruption to daily operations.
**Improved security and data protection**
RBAC follows the principle of least privilege (PoLP), a core tenet of [zero-trust](/en/topics/security/what-is-zero-trust) security, which means that a user is only granted the privileges they need to do their job. By limiting access in this manner, organizations are able to minimize unnecessary threats and reduce the risk of data breaches—as well as the associated costs.
**Improved compliance**
The use of role hierarchies allows for better visibility, oversight, and auditing. Administrators can quickly identify and correct mistakes in user permissions, allowing for better compliance with regulatory standards and more precise management of access to sensitive information and systems.
[Find out more about zero trust workload identity manager](/en/technologies/cloud-computing/openshift/zero-trust-workload-identity-manager)
How can automation help with RBAC?
----------------------------------
Businesses that lack [IT automation](/en/topics/automation/what-is-it-automation) can be impeded by inefficient, manual processes that increase costs and pose security risks. Automation tools can help teams implement RBAC, particularly in cases where system administrators want to automate the assignment of roles to users or groups with specific attributes. Automating RBAC policies can lower the incidence of human errors—like assigning the incorrect role to a user or outfitting a role with incorrect permissions—and protect sensitive data.
Additionally, a strong RBAC system is necessary for managing access to automation resources including inventories and specific projects. Automation teams can use RBAC to establish an efficient, scalable role hierarchy with carefully configured permissions to ensure better security, compliance, and coordination across the enterprise.
[Learn how to set up role-based access control in automation controller](https://docs.ansible.com/automation-controller/latest/html/userguide/security.html#role-based-access-controls "Learn how to set up role-based access control in Automation controller")
How can Red Hat help?
---------------------
As the leading provider of enterprise open source software solutions, Red Hat gives you the tools necessary for managing role-based access control across environments.
[Red Hat® Ansible® Automation Platform](/en/technologies/management/ansible) helps you automate manual tasks and speed up time-to-value while facilitating automation at the scale, complexity, and flexibility required of the modern enterprise. As the control plane of Ansible Automation Platform, [Automation controller](/en/technologies/management/ansible/automation-controller) allows administrators to define, operate, and delegate automation across teams. It provides granular, [built-in RBAC capabilities](https://aap2.demoredhat.com/exercises/ansible_network/8-controller-rbac/) and integrates with [enterprise authentication systems](https://docs.ansible.com/automation-controller/latest/html/administration/ent_auth.html) to ensure that automation includes the security and compliance to meet business standards.
RBAC in automation controller helps reduce the repetition of manual tasks by providing predefined roles to grant access to controller objects like credentials, inventories, job templates, and more. You can also establish collections of controller objects, called “organizations,” and assign users as members with specific read, write, or execute privileges.
If you’re looking to bring improved security, compliance, and operational efficiency to IAM in container orchestration, [Red Hat OpenShift®](/technologies/cloud-computing/openshift) can help you manage user access to pods, nodes, and entire clusters. An enterprise-ready hybrid cloud application platform, Red Hat OpenShift allows you to manage, deploy, and scale containerized applications while taking advantage of powerful Kubernetes components—including security features like [Kubernetes RBAC](/en/topics/containers/what-kubernetes-role-based-access-control-rbac).
[Get started with RBAC in automation controller](/en/technologies/management/ansible/automation-controller)
Recommended for you
E-book
Enhance security with automation: A Red Hat customer success series
-------------------------------------------------------------------
Automation can help your organization protect its data, applications, IT systems, networks, and devices from malicious threats. Read the e-book.
[Read the e-book](https://www.redhat.com/en/resources/enhance-security-with-automation?percmp=RHCTG0250000455234)
All Red Hat product trials
--------------------------
Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization.
[Keep reading](/en/products/trials "All Red Hat product trials")
Keep reading
------------
### What is post-quantum cryptography?
Learn about Red Hat’s approach to post-quantum cryptography, which refers to encryption algorithms that can resist attacks from quantum computers.
[Read the article](/en/topics/security/post-quantum-cryptography "What is post-quantum cryptography?")
### What is confidential computing?
Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it.
[Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?")
### What are SPIFFE and SPIRE?
SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems.
[Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?")
Security resources
------------------
### Related content
* Blog post
  [End-to-end security for AI: Integrating AltaStata Storage with Red Hat OpenShift confidential containers](/en/blog/end-end-security-ai-integrating-altastata-storage-red-hat-openshift-confidential-containers)
* Blog post
  [Understanding security embargoes at Red Hat](/en/blog/Understanding-security-embargoes-at-Red-Hat)
* Blog post
  [New observability features in Red Hat OpenShift 4.20 and Red Hat Advanced Cluster Management 2.15](/en/blog/new-observability-features-red-hat-openshift-420-and-red-hat-advanced-cluster-management-215)
* Blog post
  [2025 was a year of transformative customer success with Red Hat Ansible Automation Platform](/en/blog/2025-was-year-transformative-customer-success-red-hat-ansible-automation-platform)
### Related articles
* [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography)
* [Automating Microsoft Windows with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/automate-microsoft-windows-with-ansible)
* [What is confidential computing?](/en/topics/security/what-is-confidential-computing)
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is DevOps automation?](/en/topics/automation/what-is-devops-automation)
* [What is IT service management (ITSM)?](/en/topics/automation/what-is-it-service-management-itsm)
* [What is Infrastructure as Code (IaC)?](/en/topics/automation/what-is-infrastructure-as-code-iac)
* [Ansible vs. Kubernetes: how they work together](/en/topics/automation/Ansible-vs-Kubernetes)
* [What is cloud migration? And how can automation help?](/en/topics/automation/what-is-cloud-migration)
* [What is a configuration management database (CMDB)?](/en/topics/automation/what-is-a-configuration-management-database-cmdb)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [What is a software-defined data center (SDDC)?](/en/topics/automation/what-is-a-sddc)
* [What is IT automation?](/en/topics/automation/what-is-it-automation)
* [Why choose Red Hat Ansible Automation Platform as your AI foundation?](/en/topics/automation/automation-and-ai)
* [How to build an IT automation strategy](/en/topics/automation/build-an-automation-strategy)
* [What is access control?](/en/topics/security/what-is-access-control)
* [What is virtual infrastructure management? And how can automation help?](/en/topics/automation/virtual-infrastructure-management)
* [What is IT migration?](/en/topics/automation/what-is-it-migration)
* [How to automate migrations with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/automate-migrations-with-red-hat-ansible-automation-platform)
* [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [What is CloudOps?](/en/topics/automation/what-is-cloudops)
* [Red Hat Satellite on Red Hat Enterprise Linux](/en/technologies/management/satellite/satellite-for-rhel)
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [What is kubernetes security?](/en/topics/containers/kubernetes-security)
* [Which Red Hat Ansible Automation Platform deployment option is right for you?](/en/technologies/management/ansible/ansible-deployment-options)
* [What is an Ansible module—and how does it work?](/en/topics/automation/what-is-an-ansible-module)
* [How to manage and automate applications at the edge](/en/topics/edge-computing/how-to-manage-automate-applications-edge)
* [How to build an automation Center of Excellence](/en/topics/automation/how-to-build-automation-center-of-excellence)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [What is orchestration?](/en/topics/automation/what-is-orchestration)
* [How to adopt Automation as Code: Extending Infrastructure as Code into Policy as Code](/en/topics/automation/how-to-adopt-automation-as-code)
* [What is a webhook?](/en/topics/automation/what-is-a-webhook)
* [Learning Ansible basics](/en/topics/automation/learning-ansible-tutorial)
* [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security)
* [What is an Ansible Role—and how is it used?](/en/topics/automation/what-is-an-ansible-role)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [What is data management?](/en/topics/data-services/what-is-data-management)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [What is NetOps?](/en/topics/automation/what-is-netops)
* [What is an Ansible Rulebook?](/en/topics/automation/what-is-an-ansible-rulebook)
* [What is an Ansible Playbook?](/en/topics/automation/what-is-an-ansible-playbook)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is configuration management](/en/topics/automation/what-is-configuration-management)
* [What is event-driven automation?](/en/topics/automation/what-is-event-driven-automation)
* [Zero-Touch Provisioning and telco automation with Red Hat](/en/topics/telecommunications/zero-touch-provisioning-and-telco-automation-at-red-hat)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What is container security?](/en/topics/security/container-security)
* [What is infrastructure automation?](/en/topics/automation/what-is-infrastructure-automation)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What is YAML?](/en/topics/automation/what-is-yaml)
* [What is provisioning?](/en/topics/automation/what-is-provisioning)
* [Understanding Ansible, Terraform, Puppet, Chef, and Salt](/en/topics/automation/understanding-ansible-vs-terraform-puppet-chef-and-salt)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is cloud orchestration?](/en/topics/automation/what-is-cloud-orchestration)
* [Ansible vs. Chef: What you need to know](/en/topics/automation/ansible-vs-chef)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [Ansible vs. Salt: What you need to know](/en/topics/automation/ansible-vs-salt)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [What is a configuration file?](/en/topics/linux/what-configuration-file)
* [Ansible vs. Puppet: What you need to know](/en/topics/automation/ansible-vs-puppet)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [Ansible vs. Terraform, clarified](/en/topics/automation/ansible-vs-terraform)
* [Why choose Red Hat for automation?](/en/topics/automation/why-choose-red-hat-for-automation)
* [Ansible vs. Red Hat Ansible Automation Platform](/en/technologies/management/ansible/ansible-vs-red-hat-ansible-automation-platform)
* [What is cloud automation?](/en/topics/automation/what-is-cloud-automation)
* [What is network automation?](/en/topics/automation/what-is-network-automation)
* [What are managed IT services?](/en/topics/cloud-computing/what-are-managed-it-services)
* [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices)
* [What is business process management?](/en/topics/automation/what-is-business-process-management)
* [What is patch management (and automation)?](/en/topics/management/what-patch-management-and-automation)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [What is the Red Hat Ansible Automation Platform automation controller?](/en/technologies/management/ansible/automation-controller-product-feature)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [What is business process automation?](/en/topics/automation/what-is-business-process-automation)
* [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security)
* [Container and Kubernetes compliance considerations](/en/topics/containers/compliance)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [What is IT process automation?](/en/topics/automation/what-is-it-process-automation)
* [What is deployment automation?](/en/topics/automation/what-is-deployment-automation)
* [What is business optimization?](/en/topics/automation/business-optimization)
* [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management)
* [What is SRE?](/en/topics/devops/what-is-sre)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is robotic process automation (RPA?)](/en/topics/automation/what-is-robotic-process-automation)
* [What is network management?](/en/topics/management/what-is-network-management)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is an SOE?](/en/topics/management/what-is-an-soe)
* [What is IT system life-cycle management?](/en/topics/management/it-system-life-cycle-management)
* [What is API security?](/en/topics/security/api-security)
* [What is malware?](/en/topics/security/what-is-malware)
* [What is cloud security](/en/topics/security/cloud-security)
* [What is cloud management?](/en/topics/cloud-computing/what-is-cloud-management)
* [What's business automation?](/en/topics/automation/whats-business-automation)
[More about this topic](/en/topics/security "More about this topic")