SECAI Core · phase 10 of 15
Role-based access control
An access control model where resources are protected by ACLs that are managed by administrators and that provide user permissions based on job functions.
The Explain card
- Plain English
- Role-based access control (RBAC) protects resources with ACLs managed by administrators, granting permissions according to job function rather than to individuals one by one.
- Example
- An AI platform defines roles like "model developer", "model approver" and "auditor". Developers can train and test, approvers can promote to production, auditors can read logs but change nothing. Joining or leaving a team means changing one role assignment, not dozens of permissions.
- Why it matters
- Roles make permissions reviewable. Defenders can answer "who can push a model to production?" in one query, and separation of duties stops one person training, approving and deploying alone.
- Hook
- Permissions follow the job title, not the person.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
