Organizing permissions by user role, such as admin, staff or customer, so each role sees and does only what it should.
RBAC stands for role-based access control. Instead of granting permissions person by person, you define roles such as manager, accountant and receptionist, each with a specific set of permissions, then assign each user one or more roles. Permission management becomes simpler and clearer.
Any app with more than one type of user needs it: the clinic receptionist sees appointments but not financial reports, and a doctor sees only their own patients' files. Permission mistakes are among the most common causes of data leaks, so they must be enforced on the server, not just hidden in the interface.
Practical tip: start with the fewest roles that cover your business and give each role the least access it needs. Test it yourself: sign in as each role and try to reach pages or data it should not see. Fix any gap you find before launch.