role-based access control

Security Patterns

Meaning

Role-based access control (RBAC) is a security pattern where access permissions are assigned to roles rather than individual users, and users are granted permissions based on the roles they occupy. Use RBAC when you need to manage permissions for many users with similar responsibilities.

Primary Function

Security and authorization

Communicative Purpose

Centralizes permission management and simplifies role changes.

Pattern

if user.role in allowed_roles: permit(action) else: forbid(action)

Core Structure

if ... in ...: ... else: ...

Função primária

Security and authorization

Propósito comunicativo

Centralizes permission management and simplifies role changes.

Situações de gatilho

Building multi-user applications, SaaS platforms with tiered plans, internal tools with admin/user distinctions.

Contextos

Web backends, enterprise systems, cloud services, any codebase with user authentication and authorization layers.

Padrão

if user.role in allowed_roles: permit(action) else: forbid(action)

Estrutura central

if ... in ...: ... else: ...

Slots de substituição

user: object with a role attribute; role: str or enum representing the user's role; allowed_roles: collection of role identifiers that are permitted; action: callable or permission token representing the operation to protect.

Colocados típicos

authentication middleware
permission decorators
role hierarchies
least privilege principle

Substituições comuns

using decorators
using policy objects
using access control lists (ACLs)

Erros comuns

hardcoding role checks scattered throughout code, forgetting to update role lists when roles change, conflating authentication with authorization

Similar / contraste

Attribute-based access control (ABAC): evaluates attributes of user, resource, and environment; Discretionary access control (DAC): owners set permissions on their own objects.

Interferências

Coming from languages with annotation-based security (e.g., Java Spring @Secured): may expect similar declarative syntax; remember to implement role checks manually or via framework.

Família do chunk

principle of least privilege
separation of duties
access control list

Nuance

RBAC can become unwieldy with many fine-grained permissions; consider combining with ABAC for dynamic contexts. Avoid role explosion by keeping roles coarse-grained where possible.

Efeito pragmático

Reduces duplication of permission logic and simplifies auditing of who can do what.

Dica de memória

Think 'role = key to door'.

Nota

RBAC does not enforce attribute checks; combine with ABAC for fine-grained control.

Upgrade path

Combine with attribute-based checks or use a policy engine like OPA (Open Policy Agent).

Frequência: HighFormulaicidade: Semi-fixedTipo de construção: conceptPrioridade de aquisição: Active recallPrioridade de output: BothTag de espaçamento: Medium-term

Examples

def delete_resource(user, resource): if user.role in ('admin', 'owner'): resource.delete() else: raise PermissionError('Insufficient role')

def require_role(*allowed): def decorator(func): def wrapper(*args, **kwargs): if get_current_user().role in allowed: return func(*args, **kwargs) raise PermissionError() return wrapper return decorator @require_role('admin', 'moderator') def edit_post(post_id): ...

# Role inheritance: senior roles inherit permissions of junior roles ROLE_PERMS = { 'viewer': {'read'}, 'editor': {'read', 'write'} | ROLE_PERMS['viewer'], 'admin': {'read', 'write', 'delete'} | ROLE_PERMS['editor'] } def can_perform(user, action): return action in ROLE_PERMS.get(user.role, set())