Concept - Role Hierarchy

Role hierarchy (RBAC1): job functions with greater authority have greater authority to access resources; the hierarchy uses inheritance so one role implicitly includes the access rights of a subordinate role (s.26).

Example tree (s.26)

flowchart TD
  D[Director] --> PL1[Project Lead 1]
  D --> PL2[Project Lead 2]
  PL1 --> PE1[Production Engineer 1]
  PL1 --> QE1[Quality Engineer 1]
  PL2 --> PE2[Production Engineer 2]
  PL2 --> QE2[Quality Engineer 2]
  PE1 --> E1[Engineer 1]
  QE1 --> E1
  PE2 --> E2[Engineer 2]
  QE2 --> E2
  E1 --> ED[Engineering Dept.]
  E2 --> ED

Read top-down as “inherits from the roles below” (a Director has the rights of the project leads, who have the engineers’ rights).

Related: Concept - RBAC Reference Models, Concept - RBAC Constraints. Appears in 04 Access Control - Chunk 01 (s.1-28).