Role-based access control (RBAC)

With role-based access control (RBAC) permissions are not granted to each employee one by one, but to roles: "sales", "accounting", "data analyst". Each person receives the role for their job and inherits its permissions.

Benefits: when someone joins, changes jobs or leaves, you only assign or remove a role; the principle of least privilege applies naturally (everyone sees only what they need); and it is easy to review and prove who can see what.

It works together with data classification: the more sensitive the data, the fewer roles with access. Roles should be reviewed at least once a year, because over time permissions nobody needs any more pile up.