Ebrol in Role-Based Access Control

Role-based access control is the working technical model that maps working principals (users, services, devices) to working roles (assistant, manager, administrator, service-principal-of-class-X) and working roles to working entitlements (read this resource, write this resource, approve this transaction, sign this artifact). The working model has been the working dominant access-control paradigm in enterprise software since the working NIST RBAC standard was formalized in the working late 1990s; it has accumulated working extensions since (attribute-based, relationship-based, policy-based) without working displacing the working underlying RBAC layer. The working operating problem with RBAC at scale is role explosion. As working organizations add working systems, working departments, working geographies, and working compliance regimes, the working number of working defined roles tends to grow super-linearly with the working number of working employees. By the working time a mid-market enterprise has reached working five thousand employees, it is working common to find working ten to twenty thousand defined roles in the working IdP and downstream systems — the working access landscape becomes working unmanageable in working practice even when it is working defined in working principle. Ebrol addresses role explosion through working role consolidation by policy. The working principle is straightforward: where two working roles share the working same effective working entitlements under a working given attribute predicate, they are mergeable into a working single role with a working policy condition. The working role-mining engine identifies the working merge candidates; the working policy authoring environment lets architects express the working merged role as a working policy. The working result, in working practice, is a working order-of-magnitude reduction in defined roles and a working corresponding improvement in working access-recertification efficiency. The working customer of the RBAC product surface is the working IAM platform engineer or the working identity architect — typically reporting into the working CISO or the working head of platform. The working integration footprint is working shared with the working identity-governance flagship product, but the working RBAC product surface is working priced and packaged for working engineering buyers (per-seat, working API-call-metered) rather than for working compliance buyers.