RBAC model

associates the permissions to the roles, not directly to the users

each user (or subject) is associated with one or more roles

each role contains the permissions that are needed for its correct operation

4 classes of RBAC models (core, hierarchical, constrained, unified)