RBAC groups permissions into roles and assigns those roles to users or groups. For example, Microsoft’s Azure model combines the person or group, the role’s permissions and the resources those permissions cover. The role name alone is not enough to understand the access; its actions and scope also matter. Source: Microsoft Learn: Role-based access control

Start with the work someone needs to do

List the tasks for each role before selecting permissions. For example, distinguish viewing a booking from changing it or approving a refund where the system supports those controls. This keeps the access decision connected to a specific responsibility that can be reviewed.

Review access when responsibilities change

Check role assignments when someone moves teams or leaves and ask an owner to review exceptional access. Record why each exception is needed. That gives future reviewers a basis for deciding whether the permission still serves a current business purpose.

Written and updated by Travelgenix. Sources checked on 19 October 2026. Practical advice and examples are Travelgenix editorial guidance.