RBAC (role-based access control)
Granting permissions to roles, such as admin, editor or finance, rather than to individuals, so each person sees and does only what their job needs.
Updated October 2026 · with examples from our own builds
What does RBAC mean in practice?
With role-based access control, the system defines roles and what each may do, and people are assigned roles. A finance user can issue invoices but not change prices; a viewer can browse but not delete. Adding a person becomes a matter of choosing the right role.
Rules about secrecy live in the roles: who sees margins, who can refund, who can read customer data. Putting them on paper before the build avoids screens that show the wrong numbers to the wrong team.
In the code, two details matter. Checks belong on the server, not just in hidden buttons, and a route without an explicit permission should fail closed, refusing access rather than allowing it.
RBAC at a glance
- Define
- Roles and permissions before screens
- Enforce on
- The server, for every route
- Default
- Fail closed when a permission is missing
Where has RBAC come up in our builds?
Every admin console route is gated by a role permission and fails closed, and the vendor console gives each shop a team with seats across four roles.
Workspaces have owner, admin, editor and viewer roles, alongside an append-only activity log of uploads, deletes and renames.
Procurement, finance and stores never see the margin or the offer rates; a screen shared by several roles comes in a variant for each, so the margin appears only where it is allowed. Designed, not yet built.
Common questions about RBAC
How many roles does my product need?
As many as there are genuinely different jobs, and no more. Start from what each team must see and must never see; QKE's system has nine roles, from sales to the store keeper, because each handles a different step.
Is hiding a button enough to restrict access?
No. Anyone can call the server directly, so every route must check the permission itself. Hidden buttons are for tidiness, not security.
Related terms
Sources
Planning a product and not sure where RBAC fits? Ask us, or browse all 116 terms in the glossary.