RBAC (Role-Based Access Control)
Role-based access control (RBAC) is an access management model in which permissions are assigned to roles, and users are assigned to roles based on their job function. A user's access is determined entirely by the roles they hold, making it straightforward to manage permissions at scale.
Why It Matters
RBAC has been the dominant access control model in enterprise software for over two decades. It works well when job functions are stable, roles are well-defined, and permission needs are predictable.
AI agents challenge RBAC because their tasks change continuously. An agent does not have a stable "role" in the way a human employee does. It might need repository access for one task and CRM access for the next. Assigning a static role that covers all possible agent tasks results in over-provisioning; creating a role for every task combination is unmanageable.
This limitation is why agent governance architectures increasingly adopt task-based access control (TBAC) or attribute-based access control (ABAC), where permissions are evaluated dynamically rather than assigned statically.