Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

A Revised Model for Role-Based Access Control



Wayne Jansen


Role Based Access Control (RBAC) refers to a class of security mechanisms that mediate access to resources through organizational identities called roles. A number of models have been published that formally describe the basic properties of RBAC. This report focuses on an RBAC model originally proposed by Ferraiolo and others at NIST, and formulates a revised model that fixes noted discrepancies, incorporates features from related models, and addresses new properties regarding role hierarchies. Possible future extensions to the revised model and the motivation for them are also discussed. Finally, a subset of the properties defined in the revised model is proposed as the criteria for determining whether an implementation should be classified as an RBAC system.
NIST Interagency/Internal Report (NISTIR) - 6192
Report Number


formal models, RBAC, Role Based Access Control, security mechanisms


Jansen, W. (1998), A Revised Model for Role-Based Access Control, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], (Accessed April 23, 2024)
Created July 9, 1998, Updated November 10, 2018