What Is Role-Based Access Control?

Role-Based Access Control (RBAC) means you describe a job once — Viewer, Editor, Manager — and people get those rights by joining a team that carries the role. You do not edit permissions on each user.

NIST’s least-privilege control is the same idea in standards language: allow “only authorized system access for users … that is necessary to accomplish assigned organizational tasks” (NIST SP 800-171 r3, 03.01.05 Least Privilege). HARi’s roles are that list: Create, View, Edit, Delete, Reassign, each with a reach (their teams, their business unit, or the whole workspace).

How it works

RBAC answers four questions for every user:

• What can they see? A sales role might see contacts in its business unit; a billing role sees invoices; an administrator sees everything.
• What can they create? Perhaps only editors can add companies.
• What can they edit? Viewing a deal is not the same as changing its value.
• What can they delete or reassign? Delete and “move to another team” are separate rights.

Why it matters

Without access control, everyone sees everything:

• Data security — revenue, contract terms, and private notes leak to the whole office.
• Accidental changes — a new hire overwrites a pipeline stage.
• Focus — sales does not need HR fields on screen.
• Compliance — GDPR expects access on a need-to-know basis.

Verizon’s 2024 DBIR found the human element in 68% of breaches (Verizon 2024 DBIR). A role that is too wide is how a stolen password becomes a stolen database.

How HARi CRM handles it

HARi uses roles attached to teams. Records belong to a team, so reach is “records their teams own,” “their business unit,” or “the whole organisation” — not “records I personally own.” The Owner field is the responsible person, not the lock.

Open Settings → Access → Roles. Changes apply on the next request.

Learn more: Teams and roles · Set up role permissions · Get started