One of the most common ways systems get breached is not a clever hack but excessive access: too many people able to reach too much data. Role-based access control, or RBAC, is the discipline of granting access based on what a person's job actually requires, and nothing more.
Instead of assigning permissions to individuals one by one, RBAC defines roles, a billing clerk, a support agent, an administrator, each with a specific set of permissions, and assigns people to roles. When someone changes jobs, you change their role, not a scattered list of individual grants. This makes access consistent, auditable, and far easier to manage as an organization grows.
RBAC exists to enforce the principle of least privilege: everyone gets the minimum access needed to do their job. This limits the damage if an account is compromised, since a breached low-privilege account cannot reach much, and it reduces the risk of internal misuse. The opposite, where everyone can access everything, turns a single compromised login into a full breach.
Auditors and frameworks expect to see access controlled and reviewed: who can reach what, why, and whether access is removed promptly when people leave or change roles. RBAC provides the structure to answer those questions. A system where access is ad hoc and unreviewed is a finding waiting to happen, and a real risk regardless of any audit.
Least privilege limits the blast radius.
This is general educational information, not specific security, compliance, or legal advice for your systems.