Recognizing an account is not granting every permission
Role-based access connects permissions to roles, with a user’s permitted actions depending on the relevant assignments and constraints. Identifying who is present and deciding what they may do are separate questions.
Questions you could explore
- What might two successfully logged-in users still be allowed to do differently?
- How does checking permission for a specific record differ from checking whether a user has signed in?
Start reading
- NIST Computer Security Resource CenterRole Based Access Control: FAQs
NIST’s role-based access FAQ explains role assignment, authorization, sessions, and additional constraints.
Ready to try your ideas aloud?
Your topic carries over. Record up to 2½ minutes, depending on your plan.