RBAC (Role-Based Access Control) is a security model that controls what users can see and do based on the roles assigned to them, rather than assigning permissions directly to individual users.
Core Concepts
-
Users
-
People or accounts that log in.
-
Examples:
-
Arch Brooks
-
Mary Smith
-
John Doe
-
Roles
-
A collection of permissions.
-
Examples:
-
Administrator
-
Manager
-
Supervisor
-
Employee
-
Auditor
-
Customer
-
Permissions
-
Individual actions a user is allowed to perform.
-
Examples:
-
Create User
-
Delete User
-
View Reports
-
Edit Inventory
-
Approve Payroll
-
Clock In
-
Export PDF
-
Resources
-
Things users access.
-
Examples:
-
Employee records
-
Payroll
-
Inventory
-
Reports
-
Customer database
How RBAC Works
Example:
Example Roles
| Permission | Admin | Manager | Employee | Guest |
|---|
| Login | ✓ | ✓ | ✓ | ✓ |
| View Dashboard | ✓ | ✓ | ✓ | ✓ |
| Add Employee | ✓ | ✓ | | |
| Delete Employee | ✓ | | | |
| Edit Employee | ✓ | ✓ | | |
| Clock In | ✓ | ✓ | ✓ | |
| View Payroll | ✓ | ✓ | | |
| Manage Roles | ✓ | | | |
| View Reports | ✓ | ✓ | | |
Typical Database Design
Users
Roles
Example:
Permissions
Example
User Roles
A user can have multiple roles.
Example
Role Permissions
Example
Authorization Example (PHP)
Usage
Hiding Menu Items
Users without the permission never see the menu option.
Protecting Pages
Every page should verify permissions before displaying content.
CRUD Permissions
Instead of one permission per table, use CRUD permissions.
Permission Naming Convention
Examples:
Hierarchical Roles
Higher-level roles inherit permissions from lower-level roles if your application supports role inheritance.
Example for Your Projects
Given your experience building Bootstrap 5, PHP, and MariaDB CRUD applications, a practical RBAC design could include:
| Role | Capabilities |
|---|
| System Administrator | Full access to all modules, users, and settings |
| Practice Administrator | Manage providers, patients, billing, scheduling, and reports |
| Physician | View and update assigned patient records, prescribe medications |
| Nurse | View patient charts, record vitals, manage appointments |
| Billing Clerk | Access billing, insurance claims, and payments only |
| Receptionist | Schedule appointments and register patients |
| Read-Only Auditor | View records and reports without making changes |
Permissions would be defined at the module and action level, such as:
-
Patients.Create
-
Patients.Read
-
Patients.Update
-
Patients.Delete
-
Appointments.Schedule
-
Billing.SubmitClaims
-
Reports.Export
-
Users.ManageRoles
This approach follows the principle of least privilege: each user receives only the permissions necessary to perform their job. It's scalable, easy to audit, and well suited to enterprise applications such as medical practice systems, payroll systems, and time-clock applications.