Role-based access control

How RBAC works

RBAC puts one layer between users and permissions: the role. NIST says “a role is essentially a collection of permissions” and “all access is through roles”.

The US standard, INCITS 359 (2004, revised 2012), has four parts:

Part	What it adds
Core RBAC	Users, roles, permissions and sessions
Hierarchical RBAC	A senior role inherits the permissions of a junior role
Static separation of duty	One user cannot hold two roles that conflict
Dynamic separation of duty	One user cannot start two roles that conflict in the same session

A session lets a user start only a subset of the assigned roles. For example, an administrator can work as a usual user until a task needs more.

Why RBAC matters for AI systems

An AI system adds a new caller: the model and the tools it uses. The role check must stay where the model cannot change it.

OWASP LLM06:2025 Excessive agency gives three rules:

1. Give each LLM extension the minimum permissions it needs.
2. Do each step for a user in the security scope of that user.
3. “Implement authorization in downstream systems rather than relying on an LLM to decide if an action is allowed or not.”

If the server checks the role, a prompt injection can make the agent try to get more. The server says no.

In practice

Authorization faults in AI tools. Two 2026 CVEs in Flowise show two different faults:

• CVE-2026-46444 (June 2026, CWE-862, CVSS 4.0 score 8.7). This is a missing check. The OpenAI Assistants Vector Store endpoints asked for an API key but had “no permission checks” on any operation. Fixed in 3.1.2.
• CVE-2026-30820 (March 2026, CWE-863, CVSS 4.0 score 8.7). This is an incorrect check. Flowise trusted a header that the client sets, x-request-from: internal. An authenticated tenant session could then bypass the authorization checks and call admin endpoints. Fixed in 3.0.13.

Roles in retrieval. OWASP LLM08:2025 asks for “permission-aware vector and embedding stores”. Without them, users of one vector database can get text that belongs to a different group. Microsoft says its Copilot “only surfaces organizational data to which individual users have at least view permissions”. That is a vendor claim, and it depends on correct permissions in SharePoint and the other sources.

Roles in infrastructure. Kubernetes uses Roles and RoleBindings. A RoleBinding gives a role to users, groups or service accounts. The permissions are “purely additive (there are no “deny” rules)“.

Trade-offs of RBAC

RBAC is simple at the start. OWASP lists four problems at scale:

• Role explosion. Many small roles become hard to manage.
• Missed checks. In large projects, “it is easy to miss or improperly perform role checks”.
• Tests and audit. More roles make the two harder.
• Many tenants. RBAC is “poorly suited” when different customers need access to the same resources.

Because of these problems, OWASP says attribute based or relationship based control “should typically be preferred for application development”. ABAC is also better at least privilege, says OWASP. NIST SP 800-162 (2014) defines ABAC.

Questions and answers

What is the difference between RBAC and ABAC?

RBAC gives access from the roles of a user. NIST SP 800-162 defines ABAC. ABAC gives access from attributes of the user, the resource, the step and sometimes the environment. OWASP says ABAC gives better least privilege. OWASP prefers ABAC or relationship based control for new software.

Does RBAC stop prompt injection in an AI agent?

No. RBAC does not stop the injected text. RBAC limits what the injected text can make the agent do. The tools must operate with the role of the user, and the server must check that role on each call. Then a hijacked agent can do only what that user can do. OWASP says to put authorization in the downstream systems, not in the LLM.

What is a missing role check?

A missing role check is an endpoint or action that does not check the role of the caller. MITRE lists this weakness as CWE-862, Missing Authorization. In June 2026, CVE-2026-46444 showed it in Flowise: its vector store endpoints had no permission checks.