// GLOSSARY

RBAC (Role-Based Access Control)

An authorization model that governs which operations user and service identities may perform on which resources, through roles and bindings rather than individual permissions. Its prevalence comes from manageability: instead of assigning permissions to hundreds of users one by one, permissions are gathered in roles and users are bound to roles. But the critical subtlety for security is this: a role being assigned is not evidence that a control exists. Because real access, that is, effective permissions, arises from roles stacking, inheritance relationships and conditions, and often differs from the simple sum of individual roles. Two roles believed to be 'read only' can, combined, produce an unexpected write authority, or if a role carries the right to assume another, scope can widen through transitive privilege. So 'a role is assigned' does not mean 'the authority is correct'; the security of an RBAC configuration is tested not by reading role definitions but by verifying each identity's computed real access. The control is shown not by a claim but by a computed outcome.