What is role-based access control (RBAC)?
Role-based access control means people are given roles, and roles are given permissions. You decide what a Viewer can do once, not per person.
Last checked
Role-based access control, RBAC, is the way most software decides who may do what. Instead of ticking permissions for each person, you define a few roles — say Viewer, Contributor, Administrator — decide what each role may do, and give each person a role. Change what a role may do and everyone holding it changes at once. It is the difference between a policy and a pile of exceptions.
The two rules that make it safe
- Fail closed: anything not explicitly allowed is refused.
- A role can only narrow, never widen: a role on one board cannot grant more than the person’s role in the organisation allows.
In plain words, in fenbs
fenbs never says RBAC in the interface. A person manages “who can do what”. A role is a name and a short list: see the board, add and edit tasks, move tasks between lanes, comment, see who is on the board, invite and remove people, change roles. The smallest useful role lets someone report a bug and nothing else. Every refusal names the role and the missing permission in a sentence.
The part other tools miss: assistants
An AI assistant connected to fenbs holds a role too — the role of the person who approved it, narrowed further by the scopes they ticked. Both limits apply and the narrower one wins. Revoke the assistant and it stops; the person’s own access is untouched. That is RBAC applied to the one kind of member most tools forgot.