Introducing the Role-Based Access Control Model

With the enactment of strict compliance-related legislation, like the Sarbanes-Oxley (SOX) Act, the Health Insurance Portability and Accountability Act (HIPAA), and the Gramm-Leach-Bliley (GLB) Act, it has become imperative for companies to secure their information and exercise control over access to mission-critical applications within the organization. Oracle understands that organizations today need a strong governance environment around access control. To establish strong governance, a robust framework around access control is necessary. This can be attained using the Role Based Access Control (RBAC) framework and an enterprise-wide role definition effort.

Role-based access control (RBAC) limits access to system applications to only authorized users within an organization. The model simplifies identity and access control compliance by managing access based on a user's roles within a company, not on an individual, user-by-user basis. Roles are created based on usage and enterprise policies. For example, new employees need access to certain system applications in order to perform their job responsibilities. Using the RBAC model, the new employees can be assigned to existing roles, which automatically give them access to the necessary set of system applications. Business managers are required to check and certify or revoke access to system applications on a regular basis.