Coursify

Access Control Models: Role-Based vs User-Based Permissions

Access Control Models: Role-Based vs User-Based Permissions

Verified Sources
Sep 12, 2026

In access control, there are several well-known models that differ in who gets the permissions directly (users vs roles) and how policies are enforced. The question asks:

Which access control model assigns permissions to roles instead of individual users?

The correct choice is (iii) RBAC — Role-Based Access Control. 2

A compact way to remember the distinction:

Key keywords: Role-Based Access Control (RBAC) Discretionary Access Control (DAC) Mandatory Access Control (MAC) Firewall

Footnotes

  1. NIST RBAC (Role-Based Access Control) overview and core concepts - NIST glossary entry describing RBAC as assigning permissions to roles. ↩

  2. Wikipedia: Role-based access control (RBAC) - Explains RBAC as permissions assigned to roles rather than individual users. ↩

type="tip" title="Quick Answer" content="Choose (iii) RBAC because RBAC assigns permissions to roles, then assigns users to those roles. 2"

Footnotes

  1. NIST RBAC (Role-Based Access Control) overview and core concepts - NIST glossary entry describing RBAC as assigning permissions to roles. ↩

  2. Wikipedia: Role-based access control (RBAC) - Explains RBAC as permissions assigned to roles rather than individual users. ↩

Why RBAC matches the “roles instead of individual users” description

RBAC is defined so that permissions are associated with roles, not directly with users. Users obtain permissions by being authorized for one or more roles. 2

In RBAC, the typical structure is:

That means if you add a permission to a role, every user in that role inherits the new permission automatically, which is fundamentally different from models that attach permissions more directly to individuals.

Footnotes

  1. NIST RBAC (Role-Based Access Control) overview and core concepts - NIST glossary entry describing RBAC as assigning permissions to roles. ↩

  2. Wikipedia: Role-based access control (RBAC) - Explains RBAC as permissions assigned to roles rather than individual users. ↩

Why the other options are not correct

(i) DAC — Discretionary Access Control

DAC generally centers access decisions around object ownership and the owner's discretion (e.g., an owner can grant access). This does not primarily mean “permissions are assigned to roles” as the question states.

(ii) MAC — Mandatory Access Control

MAC relies on system-enforced policy using security labels (and often hierarchical/clearance rules). It does not assign permissions to roles as the primary abstraction.

(iv) Firewall

A firewall is primarily a network traffic filtering mechanism (rule-based packet/connection filtering), not an access control model that assigns permissions to roles vs users in the RBAC sense.

Footnotes

  1. Wikipedia: Discretionary access control - Explains DAC as discretionary control often based on object ownership and permissions. ↩

  2. Wikipedia: Mandatory access control - Describes MAC as label-based mandatory policy enforcement. ↩

  3. Wikipedia: Firewall - Defines firewalls as network security controls that filter traffic based on rules. ↩

Model comparison (exam-ready)

ModelPrimary abstraction for access decisionsPermissions assigned to…Typical enforcement basis
DAC (i)Object ownership / discretionOwners/users (directly or via object permissions)Owner discretion over resources
MAC (ii)Security labels / policiesSecurity subjects and objects under labeled policyMandatory system policy
RBAC (iii)RolesRoles (users get permissions via role membership)Role-policy mapping 2
Firewall (iv)Network rulesNot “roles” in the RBAC sensePacket/connection filtering policy

Footnotes

  1. Wikipedia: Discretionary access control - Explains DAC as discretionary control often based on object ownership and permissions. ↩

  2. Wikipedia: Mandatory access control - Describes MAC as label-based mandatory policy enforcement. ↩

  3. NIST RBAC (Role-Based Access Control) overview and core concepts - NIST glossary entry describing RBAC as assigning permissions to roles. ↩

  4. Wikipedia: Role-based access control (RBAC) - Explains RBAC as permissions assigned to roles rather than individual users. ↩

  5. Wikipedia: Firewall - Defines firewalls as network security controls that filter traffic based on rules. ↩

How to identify the correct model for a multiple-choice question

  1. 1
    Step 1

    If permissions are granted via roles, the model is RBAC. 2

    Footnotes

    1. NIST RBAC (Role-Based Access Control) overview and core concepts - NIST glossary entry describing RBAC as assigning permissions to roles. ↩

    2. Wikipedia: Role-based access control (RBAC) - Explains RBAC as permissions assigned to roles rather than individual users. ↩

  2. 2
    Step 2

    If access depends on object ownership or an owner’s choice, it is DAC.

    Footnotes

    1. Wikipedia: Discretionary access control - Explains DAC as discretionary control often based on object ownership and permissions. ↩

  3. 3
    Step 3

    If access uses security labels and mandatory policy, it is MAC.

    Footnotes

    1. Wikipedia: Mandatory access control - Describes MAC as label-based mandatory policy enforcement. ↩

  4. 4
    Step 4

    If it describes network traffic control rather than permission assignment abstractions, it’s a firewall.

    Footnotes

    1. Wikipedia: Firewall - Defines firewalls as network security controls that filter traffic based on rules. ↩

Conceptual evolution of access control abstractions

User/object discretion

DAC

Access decisions reflect ownership/discretion over resources. "

Footnotes

  1. Wikipedia: Discretionary access control - Explains DAC as discretionary control often based on object ownership and permissions. ↩

Label-driven policy enforcement

MAC

Access is governed by security labels and mandatory rules. "

Footnotes

  1. Wikipedia: Mandatory access control - Describes MAC as label-based mandatory policy enforcement. ↩

Role-centric permission management

RBAC

Permissions attach to roles; users receive rights through role membership. 2"

Footnotes

  1. NIST RBAC (Role-Based Access Control) overview and core concepts - NIST glossary entry describing RBAC as assigning permissions to roles. ↩

  2. Wikipedia: Role-based access control (RBAC) - Explains RBAC as permissions assigned to roles rather than individual users. ↩

Traffic filtering policy

Firewall

Network access is controlled by filtering rules (not role assignment). "

Footnotes

  1. Wikipedia: Firewall - Defines firewalls as network security controls that filter traffic based on rules. ↩

Common exam traps

Knowledge Check

Question 1 of 3
Q1Single choice

Which access control model assigns permissions to roles instead of individual users?

Explore Related Topics

1

Functional Dependencies and Candidate Keys in $R(A,B,C)$

In R(A,B,C)R(A,B,C) with functional dependencies A→BA\rightarrow B and B→AB\rightarrow A, neither single attribute determines all three attributes, so AA and BB are not keys; the minimal candidate keys are {A,C}\{A,C\} and {B,C}\{B,C\}.

  • A+={A,B}A^{+}= \{A,B\} and B+={A,B}B^{+}= \{A,B\}, both missing CC → not superkeys.
  • Adding CC yields (AC)+=(BC)+={A,B,C}(AC)^{+}= (BC)^{+}= \{A,B,C\}, making ACAC and BCBC candidate keys.
  • Mutual determination (A↔BA\leftrightarrow B) does not imply key status without covering the whole schema.
  • A common exam trap is assuming AA or BB are keys because they determine each other.
  • Heuristic: any attribute not derivable from others (here CC) must appear in every candidate key.
2

Virtual Private Database (VPD): Predicate-Based Database Security

3

Symbol Table Attributes: Why the Correct Answer Is “All of These”

Browse all research articles