Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Adding Attributes to Role Based Access Control



David R. Kuhn, Edward Coyne, Timothy Weil


Role based access control (RBAC) is a popular model for information security. It helps reduce the complexity of security administration and supports the review of permissions assigned to users, a feature critical to organizations that must determine their risk exposure from employee IT system access. RBAC is frequently criticized for the difficulty of setting up an initial role structure and for inflexibility in rapidly changing domains. A pure RBAC solution may have inadequate support for dynamic attributes such as time of day, which may need to be considered in determining user permissions. To support dynamic attributes, particularly in large organizations, a role explosion problem may result where thousands of separate roles are needed for different collections of permissions. Recent interest in attribute-based access control (ABAC) suggests that attributes and rules could either replace RBAC or make RBAC more simple and flexible.
Computer (IEEE Computer)


access control, computer security, role based access control


Kuhn, D. , Coyne, E. and Weil, T. (2010), Adding Attributes to Role Based Access Control, Computer (IEEE Computer), [online], (Accessed April 22, 2024)
Created June 1, 2010, Updated November 10, 2018