Which access control model assigns permissions based on a user's role?

Which access control model assigns permissions based on a user's role?

• A. Role-Based Access Control
• B. Discretionary Access Control
• C. Rule-Based Access Control
• D. Mandatory Access Control

Answer: (A)

Permissions are linked to a user’s role rather than to individual identities. In this approach, roles represent specific job functions, and each role has a defined set of permissions. When a user is assigned to a role, they automatically gain all the permissions attached to that role. This makes managing access scalable and consistent, and it supports least-privilege by giving users only what their role requires. It also makes it easier to enforce separation of duties because roles can be designed to limit conflicting permissions. In contrast, discretionary access control lets the resource owner decide who can access the resource and what they can do, often by assigning permissions directly to users or groups. Rule-based access control makes decisions based on predefined rules or conditions (such as time or location) rather than on the user’s role. Mandatory access control relies on security labels and classifications to govern access, not roles.

Permissions are linked to a user’s role rather than to individual identities. In this approach, roles represent specific job functions, and each role has a defined set of permissions. When a user is assigned to a role, they automatically gain all the permissions attached to that role. This makes managing access scalable and consistent, and it supports least-privilege by giving users only what their role requires. It also makes it easier to enforce separation of duties because roles can be designed to limit conflicting permissions.

In contrast, discretionary access control lets the resource owner decide who can access the resource and what they can do, often by assigning permissions directly to users or groups. Rule-based access control makes decisions based on predefined rules or conditions (such as time or location) rather than on the user’s role. Mandatory access control relies on security labels and classifications to govern access, not roles.