The idea in role-based access control is to assign one or more roles to people instead of specific permissions.

Permissions are then associated with a role, and if a person has more than one role, the permissions are merged. If a new person needs a set of permissions to use an application, or if a person's role in the organization changes, only the list of roles associated with that person needs to be changed instead of having to change the permissions for this person for each type of entity in the application.

Likewise, if we would extend the available types of entities, we would only have to define what permissions associated with a role (or roles) would apply to this new entity instead of defining this for every person.

The aforementioned concepts described can be captured in this data model:

In our simplified model, a user can have one role, but a role can have one or more permissions. A permission consists of several attributes, an entity, action, and level, that together describe under which conditions something is allowed.