Role-based access control (RBAC)

Consider a process for employee review that includes an assignment to authorize a raise for an employee. The assignment is routed to a common work queue that is accessible by all members of the Human Resources (HR) department. Stakeholders want to keep employee compensation information, such as raises, private. Therefore only members of the HR department have access to compensation data. By granting authorization to specific members of the HR department, you can reduce the chance of unauthorized access to personal identifying information (PII).

To satisfy the requirement to restrict access to PII, you can implement role-based access control (RBAC). RBAC is an access-control model that organizes users into roles and assigns permissions to each role as appropriate. With RBAC, you can create a role for HR members who are authorized to access compensation information and grant that role permission to authorize employee raises. Users in other roles that are not granted permission are prohibited from authorizing raises.

Authentication versus Authorization

The Pega Platform™ implementation of role-based access control is based on two factors: authentication and authorization.

• Authentication confirms the identity of the user by validating login credentials such as the user name and password. In Pega Platform, the operator ID record contains information needed to authenticate a user.
• Authorization determines the applications that the users can access, including actions that the user can perform and information that the user can view. In Pega Platform, the access group record lists any authorized applications and roles assigned to members of the access group.

When a user signs in, Pega Platform™ identifies the default access group for the user and opens the corresponding application in the specified portal. A user can belong to multiple access groups, but only one access group is active at a time.

In the following image, click the + icons to explore how Pega Platform uses authentication and authorization to identify the correct application and portal to open when users sign in.

The RBAC model provides several types of records that are used to configure behavior satisfying access-control needs.

• Access group – Identifies the application, default portal, and assigned access roles for a group of users
• Role – Maintains a list of all access records associated with a role
• Access Deny – Restricts users access under certain conditions
• Access of Role to Object (ARO) – Specifies permissions that are granted to a role and access class
• Class – Defines collections of objects that are available to other classes or to instances of the class
• Privilege – Associates an access role with a rule that needs to be secured
• Rule – Defines the behavior of an application by serving as the building block

In the following image, click the + icons to learn more about each type of access control record.