Which model assigns access rights to roles rather than individuals?

Which model assigns access rights to roles rather than individuals?

• A. RBAC
• B. Role-Based Access Control (RBAC)
• C. Security Labels
• D. Need-to-Know Principle

Answer: (B)

Access is granted by grouping permissions into roles rather than assigning them to individuals. In Role-Based Access Control, each role carries a set of permissions, and users obtain those permissions by being assigned to a role. This makes managing access scalable in large organizations because you change someone’s access by changing their role membership or updating the role itself, not by editing permissions for every user. It also supports least privilege and easier auditing since you can review what each role can do and who has that role. Security Labels focus on data classifications and access based on those labels, not on assigning rights to roles. The Need-to-Know Principle speaks to limiting information access to what is necessary, but it isn’t a formal model for tying permissions to roles.

Access is granted by grouping permissions into roles rather than assigning them to individuals. In Role-Based Access Control, each role carries a set of permissions, and users obtain those permissions by being assigned to a role. This makes managing access scalable in large organizations because you change someone’s access by changing their role membership or updating the role itself, not by editing permissions for every user. It also supports least privilege and easier auditing since you can review what each role can do and who has that role. Security Labels focus on data classifications and access based on those labels, not on assigning rights to roles. The Need-to-Know Principle speaks to limiting information access to what is necessary, but it isn’t a formal model for tying permissions to roles.