Which access control model centralizes permissions by assigning users to roles with corresponding access rights?

Which access control model centralizes permissions by assigning users to roles with corresponding access rights?

• A. Rule-Based Access Control
• B. Role-Based Access Control
• C. Attribute-Based Access Control
• D. Discretionary Access Control

Answer: (B)

Central to this question is how permissions are organized around roles rather than individuals. In Role-Based Access Control, permissions are attached to defined roles, and users gain access by being assigned to those roles. This centralizes permission management, simplifies provisioning, and helps enforce least privilege as job functions change. It also supports role hierarchies and separation of duties. Other models function differently: rule-based control relies on policies and conditions to grant access, attribute-based control uses multiple attributes of user, resource, and environment, and discretionary access control lets resource owners decide who can access each resource. The core idea is that access rights come with roles and are granted to users through their role memberships.