Why RBAC Fails

I have seen access roles built one to one with entitlements, and access roles named after the person they were built for. Neither one helps a reviewer decide anything.

When I say role here, I mean an access role: a defined bundle of entitlements. A job role is what someone does for a living. Mixing the two up is where a lot of this goes wrong.

A program decides to build access roles. Someone pulls what people in each job currently have, finds the common access, and calls it a role. But what people currently have includes years of exceptions, "same as" copies, and access nobody removed. Mining it just gives the mess a name.

Then the access roles multiply. A role for each team, then each variation, then each person who needed one more thing. When they are built one to one with entitlements, every new entitlement means another role to create, maintain, and review.

In my experience, RBAC fails because keeping access roles accurate is nobody's job. Most programs treat them as a project: build, launch, move on. RBAC only works when it is run every day like any other process. That is a leadership decision.

You do not need an access role for every job. Start with jobs many people share and jobs with high turnover.

Give every access role an owner who can say what it is for, reviews what is inside it on a schedule, and is accountable when it drifts.

Decide on purpose which access people should simply have because of their job, and which should still be requested and approved. Making everything automatic over-grants on day one. Making everything a request puts every new hire through a week of requests.

Use role mining, and AI, as evidence. They are good at showing you what people have. Only the business can tell you what people should have.

Watch how much access is granted outside of roles. If it keeps growing, the roles are falling behind.

And retire access roles when the work they were built for goes away.

Done that way, the contractor from Post 1 gets most of what they need on day one, and a backfill gets the job's access instead of the last person's history.

Related

• Series 1 Post 8: LinkedIn post
• Series 3 Post 1: LinkedIn post
• Series 3 Post 2: LinkedIn post
• Series 3 Post 6: LinkedIn post