Which model assigns access rights to roles rather than individuals?

• A. Security Labels
• B. Role-Based Access Control (RBAC)
• C. Transaction-based Rights
• D. Need-to-Know Principle

Answer: (B)

Role-based access control assigns access rights to roles, not to individuals. In this model, permissions are organized into roles that reflect specific job functions. A user gains access by being assigned one or more roles, so changing a user’s privileges is as simple as updating their role membership rather than editing permissions on each resource. This approach promotes consistency, simplifies administration, and helps enforce separation of duties as people move between roles.

Security labels focus on tagging data with sensitivity levels rather than assigning permissions to users or roles. Transaction-based Rights isn’t a standard access-control model for role assignment, and the Need-to-Know Principle is a guiding restriction rather than a mechanism for assigning permissions to roles, though RBAC can implement it within role definitions.