How RBAC works

In role-based access control, or RBAC, permissions are assigned to organisational functions and people are linked to those functions. This avoids configuring every authorisation from scratch for each user. The model requires actions and resources to be described: reading an assessment, editing a measure, approving a record or administering users are different capabilities.

A job title does not settle the full scope

The same role may need limits by company, workplace, team or file. Being a prevention technician does not imply access to the entire organisation. Health information must also be distinguished from operational conclusions. Design starts with health data protection and what each function needs to perform its work.

Separating incompatible functions

Separation of responsibilities can prevent the creator of an operation from being its sole approver or a technical administrator from routinely using clinical information. Incompatibilities are defined according to the process and risk. Adding many roles without reviewing their combinations can have the opposite effect: a person accumulates permissions and gains broader access than intended.

Managing job changes and temporary cover

Account creation is only the beginning. When someone changes workplace or responsibility, previous permissions should be removed and new ones checked. Temporary cover needs a defined scope and duration. Periodic review compares active users, assigned roles and actual needs, including contractor accounts. Exceptions need an owner and justification, avoiding permanent privileges left over from a past emergency.

Validation example

In a hypothetical example, a manager views outstanding measures at their workplace and a healthcare professional accesses the appropriate clinical record. Access that should be denied is also tested, such as changing the workplace in a search or downloading a document through a direct link. Hiding a menu option does not demonstrate that the resource is protected on the server.

Limits of the model

RBAC is a way to organise authorisations, not a certification of compliance. It can be combined with attributes and other rules when context requires. The application must be checked to ensure it applies permissions to queries, exports, APIs and automated processes, and maintains useful evidence of changes and access.