What Role-Based Access Control Is

RBAC in plain terms

Instead of granting each person custom permissions, you define roles that mirror job functions and attach permissions to those roles. When someone joins, changes teams, or leaves, you change their role — not dozens of individual settings. That keeps access aligned with responsibility.

Why compliance teams care

Vendor W-9s, exclusion screening results, employee training records, and contract terms are sensitive. RBAC ensures AP can process invoices without exporting every vendor's tax ID, and that only compliance or legal can access full screening histories. Least privilege is a baseline expectation in healthcare, finance, and government contracting.

Common roles in operational compliance

Most U.S. mid-market organizations define a small set of roles rather than per-user exceptions.

• Viewer — read assigned records, no export
• Contributor — upload documents and complete assigned tasks
• Approver — sign off on exceptions, holds, and payments
• Compliance admin — configure workflows, run reports, export evidence
• Auditor — read-only export access across a defined scope

RBAC and segregation of duties

RBAC supports segregation of duties — the person who adds a vendor should not be the only person who approves invoices to that vendor. Map roles so conflicting permissions are not combined unless explicitly approved and logged.

Avoid shared accounts

Shared logins destroy attribution in audit trails. If three people use one compliance@ company account, you cannot prove who exported a vendor file or cleared an exclusion match. RBAC works only when every action ties to an individual identity.

Review access periodically

Roles drift as people change jobs. Quarterly access reviews — or automatic deprovisioning when HR offboards someone — prevent former employees from retaining export rights. Document reviews; auditors ask who had access during the period under examination.