CoChat
Sign Up
Cited by 877Access Control and TrustUser Authentication and Security SystemsDigital Rights Management and Security

The DOI matches its Crossref record, with a small difference in title or year.

The NIST model for role-based access control: towards a unified standard

Open access
Sandhu, Ravi, Ferraiolo, David, Kuhn, Richard·2000·Proceedings of the fifth ACM workshop on Role-based access control
DOI 10.1145/344287.344301
Open this paper in CoChat — free accountOpen PDF

Abstract

This paper describes a unified model for role-based access control (RBAC). RBAC is a proven technology for large-scale authorization. However, lack of a standard model results in uncertainty and confusion about its utility and meaning. The NIST model seeks to resolve this situation by unifying ideas from prior RBAC models, commercial products and research prototypes. It is intended to serve as a foundation for developing future standards. RBAC is a rich and open-ended technology which is evolving as users, researchers and vendors gain experience with it. The NIST model focuses on those aspects of RBAC for which consensus is available. It is organized into four levels of increasing functional capabilities called flat RBAC, hierarchical RBAC, constrained RBAC and symmetric RBAC. These levels are cumulative and each adds exactly one new requirement. An alternate approach comprising flat and hierarchical RBAC in an ordered sequence and two unordered features—constraints and symmetry—is also presented. The paper furthermore identifies important attributes of RBAC not included in the NIST model. Some are not suitable for inclusion in a consensus document. Others require further work and agreement before standardization is feasible.

Overview

Integrity signals

Registry

Crossref · 10.1145/344287.344301

Cites

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Role-Based Access Control (RBAC) assigns users to roles that carry predefined privileges, supporting efficient policy administration in large organizations.

    “Role-Based Access Control (RBAC) assigns users to roles that carry predefined privileges, supporting efficient policy administration in large organizations [15].”

    From Collaborative Memory: Multi-User Memory Sharing in LLM Agents with Dynamic Access Control (2025) · cites this paper as [15]

Citations

Cites

No references could be resolved yet.

Research works printed but not linked: 21

  1. 10.1145/319171.319176 · DOI
  2. 10.1109/SP.1987.10001 · DOI
  3. 10.1145/300830.300834 · DOI
  4. David Ferraiolo , Janet Cugini , and Richard Kuhn . Role-based access control (RBAC): Features and motivations . In Proceedings of 11th Annual Computer Security Application Conference , pages 241 - 248 , New Orleans, LA, December 11- 15 1995 . David Ferraiolo, Janet Cugini, and Richard Kuhn. Role-based access control (RBAC): Features and motivations. In Proceedings of 11th Annual Computer Security Application Conference, pages 241-48, New Orleans, LA, December 11- 15 1995.
  5. David Ferraiolo and Richard Kuhn . Role-based access controls . In Proceedings of 15th NIST-NCSC National Computer Security Conference , pages 554 - 563 Baltimore, MD , October 13-16 1992 . David Ferraiolo and Richard Kuhn. Role-based access controls. In Proceedings of 15th NIST-NCSC National Computer Security Conference, pages 554-563 Baltimore, MD, October 13-16 1992.
  6. 10.1109/SECPRI.1998.674833 · DOI
  7. Luigi Guiri . A new model for rolebased access control . In Proceedings of 11th Annual Computer Security Application Conference pages 249 - 255 New Orleans LA December 11-15 1995 . Luigi Guiri. A new model for rolebased access control. In Proceedings of 11th Annual Computer Security Application Conference pages 249-255 New Orleans LA December 11-15 1995.
  8. 10.1145/266741.266749 · DOI
  9. 10.1145/300830.300832 · DOI
  10. 10.1109/RISP.1990.63851 · DOI
  11. 10.1145/354876.354878 · DOI
  12. Chandramouli Ramaswamy and Ravi Sandhu . Role-based access control features in commercial database management systems . In Proceedings of 21st NIST-NCSC National Information Systems Security Conference pages 503 - 511 Arlington VA October 5-8 1998 . Chandramouli Ramaswamy and Ravi Sandhu. Role-based access control features in commercial database management systems. In Proceedings of 21st NIST-NCSC National Information Systems Security Conference pages 503- 511 Arlington VA October 5-8 1998.
  13. 10.1109/ACSAC.1988.113349 · DOI
  14. 10.1109/2.241422 · DOI
  15. 10.1145/270152.270163 · DOI
  16. 10.1145/286884.286891 · DOI
  17. Ravi Sandhu . Role-based access control . In Zelkowitz editor Advances in Computers, Volume: 46 . Academic Press 1998 . Ravi Sandhu. Role-based access control. In Zelkowitz editor Advances in Computers, Volume: 46. Academic Press 1998.
  18. 10.1145/300830.300839 · DOI
  19. 10.1109/2.485845 · DOI
  20. 10.5555/794197.795068 · DOI
  21. T.C. Ting S.A. Demurjian and M.Y. Hu . Requirements capabilities and functionalities of user-role based security for an object-oriented design model . In C.E Landwehr and S. Jajodia editors Database Security V: Status and Prospects. Noh-Holland 1992 . T.C. Ting S.A. Demurjian and M.Y. Hu. Requirements capabilities and functionalities of user-role based security for an object-oriented design model. In C.E Landwehr and S. Jajodia editors Database Security V: Status and Prospects. Noh-Holland 1992.

Cited by

Sorted by citations

Metadata

Authors
Sandhu, R., Ferraiolo, D., & Kuhn, R.
Affiliations
  • George Mason University (US)
  • National Institute of Standards and Technology (US)
ORCID
Sandhu, Ravi
Venue
Proceedings of the fifth ACM workshop on Role-based access control
Publisher
ACM
Published
2000-07-26
Pages
47-63
DOI
10.1145/344287.344301
OpenAlex
W2060690494
Cited by
877
References
0
Citations by year
2026: 14 · 2025: 12 · 2024: 9 · 2023: 15 · 2022: 27 · 2021: 29 · 2020: 17 · 2019: 19 · 2018: 21 · 2017: 25 · 2016: 28 · 2015: 34 · 2014: 49 · 2013: 62 · 2012: 40
FWCI
83.70
Type
conference paper
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
ACM Symposium on Access Control Models and Technologies (SACMAT) (publishedVersion)
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Access Control and Trust
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Information Systems › Digital Rights Management and Security
Keywords
role-based access control, authorization

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review