A role assignment associates a principal with an authorization role. In role-based access control (RBAC), the assignment lets the system evaluate permissions through the role instead of maintaining direct user-to-resource mappings. section 5.2.1
At request time, the system identifies the principal, determines assigned roles, retrieves their permissions, resolves inherited roles, and allows or denies the action. Separation-of-duty constraints can prevent conflicting role assignments, such as payment initiation and approval. section 5.2.1
Role assignments support predictable authorization, but static assignments have limits:
- They centralize authorization around organizational roles rather than scattering individual access rules across services. section 5.2.1
- They do not by themselves express dynamic conditions such as work shifts, device posture, or patient consent. section 1.2.4 section 5.2.1
- They can become inefficient when people span departments, hold transient roles, or require many exceptions. section 1.2.4
Engineering permissions
Bob’s engineer role allows him to approve a code check-in but not deploy to production. Alice’s senior-engineer role inherits engineer and also grants production deployment, so both inherited and direct permissions affect the decision.
