RBAC assigns permissions to roles, then roles to users. This simplifies access management at scale.
Without RBAC: Manage permissions for each user individually. With users and resources, that is potential assignments.
With RBAC: Create roles like "Developer". New developers get the Developer role. Done.
Best practices:
- Create roles based on job functions
- Keep roles specific. Avoid mega-roles.
- Users can have multiple roles
- Review role definitions periodically