Role-Based Access Control is a security model where permissions are assigned to roles (e.g., "billing-admin," "read-only-analyst"), users are assigned to roles, and the combination determines what each user can do. This abstraction makes large-scale permission management tractable — a new analyst hire is assigned the appropriate role rather than having individual permissions granted one by one.
RBAC is the default permission model in most enterprise systems, including Kubernetes, most cloud IAM implementations, and most SaaS products with meaningful permission complexity. Attribute-Based Access Control (ABAC) and Policy-Based Access Control (PBAC) are extensions that support more dynamic permission decisions, but RBAC remains the most common baseline.
For AI agent deployment, RBAC design is a load-bearing concern. Autonomous agents need role assignments that grant exactly the permissions they need for their assigned work — no more. Getting this right requires careful role definition, auditing, and sometimes custom roles that do not exist in the underlying system's default role set.