Concept - RBAC Constraints

RBAC2 adds constraints, which restrict the ways in which the components of an RBAC system may be configured. A constraint is “a defined relationship among roles or a condition related to roles” (s.27).

Constraint	Meaning	Slide example
Mutually exclusive roles	a user can be assigned to only one role in the set (during a session or statically); any permission can be granted to only one role in the set	n/a
Cardinality	a maximum number with respect to roles, e.g. users per role	project leader or department head role limited to one user
Prerequisite roles	a user can only be assigned a role if already assigned some other specified role	a project lead must get the production engineer and quality engineer roles

(s.27)

Related: Concept - RBAC Reference Models, Concept - Role Hierarchy. Appears in 04 Access Control - Chunk 01 (s.1-28).