What is the difference between RBAC and ACL?

Question

Accepted Answer

**RBAC** — Role-Based Access Control. **ACL** — Access Control List.

**RBAC:**
- Access based on roles.
- Users assigned to roles.
- Roles have permissions.
- Simple to manage.

```
RBAC:
User → Role → Permissions
John → Admin → [read, write, delete]
Mary → Editor → [read, write]
(Role determines access)
```

**ACL:**
- Access per resource.
- Each resource has list.
- Granular control.
- Complex to manage.

```
ACL:
File: document.pdf
ACL:
  John: read, write
  Mary: read
  Bob: none
(Per-resource control)
```

**Key differences:**
- **RBAC** — role-based.
- **ACL** — resource-based.
- **RBAC** — simpler.
- **ACL** — granular.

Systems Analyst: What is the difference between RBAC and ACL?