Building role-based access control into business software

In most organisations, not everyone should see or change everything. Role-based access control (RBAC) puts that principle into software.

Model roles on real jobs

Define roles from how the organisation works — cashier, supervisor, accountant, clinician, administrator — and give each the permissions its tasks need.

Check on the server

Hiding a button is not security. Every request must be checked on the server against the user's permissions, including API calls and exports.

Consider data scope

Permissions often depend on data as well as actions: a branch manager sees their own branch; a clinician sees their own patients. Build scope into queries so data never leaks.

Separate duties

For sensitive processes, require a second person: the person who raises a payment cannot approve it.

Make administration easy

Administrators need clear screens to assign roles and review who has access. Review access regularly and remove what is no longer needed.

Log sensitive actions

Record who viewed or changed sensitive records, and when.

See how we build secure business systems.