Role-Based Access Control

Introduction

RBAC = permissions tied to roles, roles tied to users. USER reads their data; ADMIN manages everyone; AUDITOR reads but never writes.

Informative example

# users
id  email             ...
1   ana@acme.com
2   bob@acme.com

# roles
id  name
1   USER
2   ADMIN

# user_roles  (many-to-many)
user_id  role_id
1        1
2        1
2        2

// Endpoint
@PreAuthorize("hasRole('ADMIN')")
@DeleteMapping("/{id}") public void delete(@PathVariable Long id) { ... }

Best practices

• Store roles in their own table — never as a CSV column.
• Prefix authorities with ROLE_; Spring strips it for hasRole(...).
• For fine-grained needs (per-resource), graduate to ABAC / policies.