# What is role-based access control (RBAC)? | Corex360 > Role-based access control (RBAC) ties what each user can see and change to their role. When someone moves department, only their role assignment changes. Source: https://www.corex360.com/en/glossary/role-based-access-control Last updated: 2026-09-25 --- [Home](https://www.corex360.com/en) [Glossary](https://www.corex360.com/en/glossary) Role-based access control Glossary ยท Process, permissions, and security # What is role-based access control (RBAC)? Role-based access control (RBAC) is a model in which access rights are attached to defined roles, such as sales rep or accounts, and not handed to individuals one by one. Users take their rights from the role they are assigned. When someone changes job, only their role assignment is updated. [Request a demo](https://www.corex360.com/en/contact?konu=governance#form) What it is forHow it worksExampleIn Corex360Often confusedQuestions ## Short answer - Role-based access control (RBAC) is a model in which access rights are attached to defined roles, such as sales rep or accounts, and not handed to individuals one by one. - Granting rights person by person looks easy in a small team. - **Often confused with:** [Audit log](https://www.corex360.com/en/glossary/audit-log), Authentication ## Why use role-based access control? Granting rights person by person looks easy in a small team. As the team grows, nobody can keep track of who sees what: leavers keep their access, and people who change department keep their old rights. The role model ties rights to defined roles; people change, the role stays the same. The role model makes checking easier too. Whether the accounts role can see customer cards is answered in one place. Limiting access to personal data to what the job requires is one of the security measures KVKK, Turkey's data protection law, expects, and the role model turns it into a written arrangement. ## How are roles defined? In role-based access control, roles come from the real jobs in the company, such as sales rep, sales manager, accounting, HR or field technician. What each role can see and change and which actions it can take are written down; a user is assigned one or more roles and takes their permissions from them. A change to a role is logged with who made it. - **Roles are identified** Roles come from the real jobs in the company, such as sales rep, sales manager, accounts, HR, and field technician. - **Scope is written** Each role gets the records it can see, the ones it can change, and the actions it can take. Scope can be the person's own records, the team's, or the whole company's. - **People are assigned** Each user is assigned one or more roles and takes their rights from them. - **Changes are tracked** When a role or an assignment changes, who changed what and when is logged. Roles are reviewed at regular intervals. ## An example At a construction firm, site managers should see their own projects' records and the contracted scope, but not the price negotiation with the client. Accounts sees invoices and the payment plan but cannot change site reports. When a site manager moves to another project, only the role assignment changes; nobody has to go through permissions one by one. This page is general information, not legal advice; the regulations were last checked on 23 September 2026. **Official text:** [Personal Data Protection Law (mevzuat.gov.tr)](https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5), [Personal Data Protection Authority (kvkk.gov.tr)](https://www.kvkk.gov.tr) ## How it looks in Corex360 In Corex360, access is role based: each user sees only the records within their role's scope, and a permission change needs a manager's approval and is logged. In Corex Drive, files are permission-bound, and sharing uses timed, permissioned links that can be revoked. The same security layer runs on Corex360 Cloud and on [your own server](https://www.corex360.com/en/solutions/on-your-own-server). [Security and hosting](https://www.corex360.com/en/security)[KVKK: cloud or own server](https://www.corex360.com/en/blog/kvkk-cloud-vs-own-server) ## Terms often confused with it | [Audit log](https://www.corex360.com/en/glossary/audit-log) | Access control decides in advance who can do what. An audit log shows afterwards what was done. The two work together. | | Authentication | Authentication confirms that users are who they say they are, through a password and a verification code. Access control decides what the verified person can reach. | **Related terms:** [Audit log](https://www.corex360.com/en/glossary/audit-log), [Data processing agreement (DPA)](https://www.corex360.com/en/glossary/data-processing-agreement) ## FAQ ### In role-based access control, can one user have several roles? In most systems, yes, and the rights add up across roles. Keeping roles few and meaningful makes it possible to explain who sees what. ### Is role-based access enough for data protection compliance? Not on its own, but it is one of the measures you need. It is assessed together with access logs, encrypted backups, privacy notices, and retention periods. ### In role-based access control, should managers see everything? Only what the job requires. A manager's role can be broad, but areas such as personal data and pay are open only to the roles that need them. [Business software glossary](https://www.corex360.com/en/glossary) Was this page useful?