Role-based access control
Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
Secure APIs
Role-based access control is an authorization model that grants permissions according to assigned user roles.
- How it is used
- Defines permission sets for user groups and restricts API operations according to those roles.
- How deep it goes
- Explains role claims, per-operation checks, granular scopes, implementation, privilege escalation, and automated tests.
- Examples
- Uses healthcare roles, separate role APIs, admin endpoints, permission claims, and tests against GET /admin/students.
- What you can do after
- Build it from configured roles, token claims, authorization checks, protected endpoints, and tests for privilege escalation.
Software Security for Developers
Role-based access control is an access-control technique that grants permissions through roles, with role definitions potentially isolated for different organizational contexts.
- How it is used
- Controls access to applications, APIs, dashboards, and services by mapping responsibilities to reusable permission bundles.
- How deep it goes
- Defines roles, permissions, token claims, and checks, then stops short of handling dynamic attributes and relationships directly.
- Examples
- Uses employee, manager, and admin roles, JWT role claims, Spring Security annotations, and tenant-specific inventory permissions.
- What you can do after
- Apply it via role assignments, token claims, and framework checks, while recognizing when finer-grained models are needed.
Read how Software Security for Developers explains role-based access control →
Authorization in Action
Role-based access control is an authorization model that assigns permissions to roles and grants principals those roles rather than assigning permissions directly to each principal.
- How it is used
- Provides a structured authorization foundation for stable job responsibilities, onboarding, audits, and separation of duty.
- How deep it goes
- Explains role assignment, runtime evaluation, inheritance, architectural mapping, and limitations, while deferring dynamic policy mechanics to other models.
- Examples
- Uses customer-support, engineer, senior-engineer, payment approval, code check-in, and production deployment scenarios.
- What you can do after
- Evaluate/understand when role-derived permissions provide clear, auditable access decisions and when contextual needs exceed RBAC.
Read how Authorization in Action explains role-based access control →
Acing the Certified Kubernetes Administrator Exam, Second Edition
Role-based access control is an authorization model that grants permissions according to assigned roles.
- How it is used
- Controls which authenticated users and Service Accounts may act on Kubernetes API resources.
- How deep it goes
- Works through scoped permission objects, kubectl creation, YAML inspection, and allowed-versus-denied checks; does not develop authorization internals.
- Examples
- Uses a pod-reader Role, a user RoleBinding, YAML output, and kubectl auth can-i checks for getting versus deleting pods.
- What you can do after
- Apply it via kubectl to assign scoped permissions and verify whether a user or Service Account can perform an action.
MongoDB 8.0 in Action, Third Edition
Role-based access control (RBAC) is an authorization model that grants permissions through roles assigned to users or applications.
- How it is used
- Controls authorized actions in Atlas organizations and projects and on MongoDB databases and collections.
- How deep it goes
- Defines roles, privileges, inheritance, and combined access, then illustrates custom-role creation with Atlas CLI commands.
- Examples
- Contrasts built-in read and write roles and creates custom roles with collection privileges or an inherited read role.
- What you can do after
- Operate/configure it by choosing built-in database roles or creating Atlas custom roles with explicit privileges and inherited roles.
Read how MongoDB 8.0 in Action, Third Edition explains role-based access control →
Google Anthos in Action
Role-based access control (RBAC) is an authorization model that grants permissions according to roles assigned to users or other principals.
- How it is used
- Controls access to Kubernetes objects in shared clusters and remains effective for requests proxied through Anthos Connect.
- How deep it goes
- Distinguishes namespace and cluster scopes for roles and bindings, but stops short of configuring RBAC policies.
- Examples
- Traces a Google Cloud UI request to a cluster and compares the scopes of Kubernetes roles and bindings.
- What you can do after
- Evaluate/understand it by separating cluster RBAC authorization from the project permission required for access through Connect.
Read how Google Anthos in Action explains role-based access control →
Architecting an Apache Iceberg Lakehouse
Role-based access control is an authorization technique that grants permissions according to assigned user or service roles.
- How it is used
- Centralizes authorization across lakehouse catalogs, engines, namespaces, tables, and storage access paths.
- How deep it goes
- Explains role assignment, identity integration, credential vending, auditing, and limits around row- and column-level enforcement.
- Examples
- Uses analyst and engineer roles, healthcare metrics, BI dashboards, research notebooks, and catalog namespace permissions.
- What you can do after
- Operate/configure governed lakehouse access by defining roles, integrating identities, coordinating engine policies, and auditing authorization activity.
Read how Architecting an Apache Iceberg Lakehouse explains role-based access control →
Snowflake Data Engineering
Role-based access control is an access-control model that assigns permissions through roles associated with users or processes.
- How it is used
- Controls authorized access to Snowflake pipeline layers and database objects through assigned roles.
- How deep it goes
- Works through a role hierarchy, managed schemas, privilege grants, future grants, and access verification.
- Examples
- Uses RAW and RPT schemas, BAKERY_FULL and BAKERY_READ, DATA_ENGINEER and DATA_ANALYST, and an EMPLOYEE view.
- What you can do after
- Operate/configure it by creating access and functional roles, granting privileges, and restricting reporting access.
Read how Snowflake Data Engineering explains role-based access control →
Building Web APIs with ASP.NET Core
A role-based claims mechanism is an authorization approach that grants or restricts access according to roles represented in caller claims.
- How it is used
- Restricts board-game API updates, deletions, and database seeding according to user roles rather than authentication alone.
- How deep it goes
- Walks through role creation, user assignment, JWT role claims, endpoint rules, and verification; defers more complex claim requirements to policies.
- Examples
- Tests role-restricted Minimal API endpoints with roleless, moderator, and administrator JWTs through SwaggerUI.
- What you can do after
- Apply it via ASP.NET Core Identity and Authorize attributes to restrict endpoints by role and verify access with JWTs.
Read how Building Web APIs with ASP.NET Core explains role-based access control →
Kubernetes for Developers
Role-based access control is an authorization model that grants permissions according to assigned roles rather than directly to individual identities.
- How it is used
- Restricts developers to permitted cluster resources, commonly within a team namespace, while operators retain control of security settings.
- How deep it goes
- Explains additive permission rules and walks through namespace and cluster-level objects, but does not develop network or container isolation.
- Examples
- Tests a developer Role and RoleBinding with successful team-namespace deployment and forbidden default-namespace deployment and namespace-label change.
- What you can do after
- Build it from scratch by defining Kubernetes roles and bindings, then verify the intended access boundaries with kubectl.
Read how Kubernetes for Developers explains role-based access control →
Grokking Relational Database Design
Role-based access control is an access-control model in which permissions are assigned to roles and users receive permissions through those roles.
- How it is used
- Protects database confidentiality by controlling who may view, modify, or delete data through assigned roles.
- How deep it goes
- Works through role creation, permission grants, user assignment, and default-role configuration with SQL examples.
- Examples
- Uses high-school records and Sci-Fi Collective tables to illustrate standard-user, analyst, and admin permissions.
- What you can do after
- Apply it via SQL by creating roles, granting table permissions, assigning users, and enabling default roles.
Read how Grokking Relational Database Design explains role-based access control →
Microsoft Azure in Action
Role-based access control is an authorization method that grants permissions according to assigned roles.
- How it is used
- Controls who can access Azure resources, what they can do, and where their access applies.
- How deep it goes
- Defines RBAC’s three components and compares built-in with custom roles, but does not walk through a complete role assignment.
- Examples
- Uses a protected virtual machine and an Azure CLI command that designates an Entra ID account as SQL server admin.
- What you can do after
- Evaluate/understand it by checking an identity’s role definition and scope before granting Azure resource access.
Read how Microsoft Azure in Action explains role-based access control →
Generative AI in Action
Role-based access control is an authorization method that assigns permissions to roles and grants users access through those roles.
- How it is used
- Protects LLM repositories and training environments while enabling Azure OpenAI API calls without key-based authentication.
- How deep it goes
- Explains role assignment, least privilege, auditing, and network restrictions, but stops short of detailed permission configuration.
- Examples
- Uses Azure OpenAI user or contributor roles and a Python client configured with DefaultAzureCredential and a bearer-token provider.
- What you can do after
- Operate/configure Azure OpenAI access by assigning roles to managed identities instead of distributing authentication keys.
Read how Generative AI in Action explains role-based access control →
ScyllaDB in Action
Role-based access control is an authorization model in which permissions are assigned to roles and clients act through those roles.
- How it is used
- Protects the restaurant-review application by giving its API only the database capabilities it needs.
- How deep it goes
- Descends from the authorization model to role creation, permission grants, login configuration, and inherited permissions.
- Examples
- Uses cqlsh authentication, application and reviews_api roles, reviews keyspace grants, and LIST ALL permission inspection.
- What you can do after
- Operate ScyllaDB authorization by creating roles, granting keyspace permissions, enabling login, and composing inherited access.
Read how ScyllaDB in Action explains role-based access control →
Data Pipelines with Apache Airflow, Second Edition
Role-based access control is an authorization technique that grants permissions according to assigned user or group roles.
- How it is used
- Controls which Airflow users and teams can view or modify DAGs, secrets, UI components, and security settings.
- How deep it goes
- Explains role assignment, default permission sets, fine-grained UI permissions, and shared-instance trade-offs; it stops short of implementation internals.
- Examples
- Demonstrates Airflow’s login screen, user-registration command, default roles, permission table, and shared-versus-separate team instances.
- What you can do after
- Operate/configure Airflow by creating users, assigning roles, inspecting permissions, and choosing an isolation model for teams.
Read how Data Pipelines with Apache Airflow, Second Edition explains role-based access control →
Effective Platform Engineering
Role-based access control is an authorization method that grants permissions according to assigned roles.
- How it is used
- Uses team membership to provide self-service, consistent access across platform tools, infrastructure, observability, and custom APIs.
- How deep it goes
- Connects authentication, team lookup, permission mapping, and resource access, while deferring complete identity-provider implementation options.
- Examples
- Uses GitHub teams, CircleCI context permissions, synchronized SaaS memberships, Kubernetes resources, and custom platform APIs.
- What you can do after
- Operate platform access through team membership while preserving secure, consistent permissions across connected tools and infrastructure.
Read how Effective Platform Engineering explains role-based access control →
Related concepts
- roleuses · A role is a defined function, responsibility, perspective, or set of permissions associated with a participant in an organization or system.
- attribute-based access controlcontrasts with · Attribute-based access control is an authorization model that evaluates subject, resource, action, and contextual attributes against policies to make access decisions.
- authorizationkind of · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
- authorization modelkind of · An authorization model is a formal scheme that represents authority and determines whether subjects may perform actions on resources.
- vault access policyalternative to · A vault access policy is an authorization configuration specifying which identities may perform permitted operations on secrets, keys, or certificates.
- authorization decisionkind of · An authorization decision determines whether a principal is permitted to access a resource or perform an action under applicable permissions or policy.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.