--- title: "RBAC in Data Governance: A Complete Guide for Scalable, Secure Access Across Your Data Estate" url: "https://atlan.com/know/rbac-access-data-governance/" description: "Access control models decide which data an agent or user can touch, keeping the rules an agent inherits in policy." author: "Emily Winks" author_role: "Data Governance Expert" published: "2025-10-08" updated: "2025-10-08" --- > Atlan is hosting Context Conference, bringing together the leaders and builders at the frontier of giving AI the context it needs to understand their business. It runs online on October 28, 2026, from 11:00 AM to 2:00 PM ET. Atlan co-founder Prukalpa Sankar opens and closes the day. Leaders from AstraZeneca, BNY and Verizon share why they invest in context and what they get from it. Registrants get early access to The AI Context Gap, a new study from MIT Technology Review Insights. Register: https://atlan.com/context-conference/ The conference for teams teaching AI their business October 28 / 11 AM ET / Virtual. Join the leaders and builders defining the context layer, the missing infrastructure of the AI era. Save Your Spot → ## What are the main types of access models in data governance? An agent inherits the governance rules of the data it reads. Without governance, agents leak data they shouldn't. Access control models decide which data an agent or user is allowed to touch in the first place. They define how organizations grant and manage access to data, and in data governance, choosing the right model is critical for balancing security, compliance, and operational efficiency. The three most common models are: * Discretionary Access Control (DAC) * Mandatory Access Control (MAC) * Role-Based Access Control (RBAC) ### 1. Discretionary Access Control (DAC) In DAC, data owners determine who can access their assets. Permissions are assigned at the discretion of individuals, which allows flexibility but increases risk, especially in large organizations. **Best for:** Collaborative environments with fewer compliance restrictions. **Example:** A data analyst shares a dashboard with a teammate by manually granting them access. ### 2. Attribute-Based Access Control (ABAC) Access is determined by a set of dynamic attributes,such as user role, department, data sensitivity, location, or time of access. ABAC offers fine-grained control, making it ideal for complex data environments. **Best for**: Large, complex environments with diverse access needs. **Example**: A user can access financial data only if they belong to the Finance department and are working within business hours. ### 3. Role-Based Access Control (RBAC) RBAC grants access based on a user's role within the organization. Roles (e.g., Analyst, Engineer, Steward) are centrally managed and aligned with job functions or responsibilities. **Best for:** Organizations with clearly defined roles and a need for scalable, manageable access control. **Example:** All data analysts have read-only access to sales data, while only the data engineering team can edit it. ### DAC vs. ABAC vs. RBAC: A quick comparison While each access control model has its unique approach, RBAC remains one of the most widely adopted due to its simplicity and scalability. Let's see how RBAC, ABAC, and DAC differ in their approaches to access control. Access modelDescriptionWho controls accessBest forDAC (Discretionary Access Control)Data owners decide who can access their assetsIndividual users (data owners)Collaborative environments with lower security needsABAC (Attribute-Based Access Control)Access granted based on user, resource, or environment attributesPolicy engine using rules and metadataComplex environments needing fine-grained controlRBAC (Role-Based Access Control)Access based on user roles like Analyst, Admin, or StewardCentral admins defining roles and permissionsOrganizations with clearly defined job roles and responsibilities --- ## How does RBAC work in data governance? RBAC in data governance links user roles to specific access permissions, ensuring that only the right people can access the right data at the right time. Here's a 5-step process to show how RBAC works in data governance. --- --- ## How can you implement RBAC in data governance with Atlan? Atlan simplifies RBAC by offering an intuitive way to create roles and assign access based on business context. Atlan's governance and orchestration platform establishes metadata-driven, policy-enforced access control across the modern data stack. Key capabilities include: * Define roles aligned to business personas, data domains, or projects * Govern access using metadata tags (e.g., PII, confidential, business unit, domain, etc.) – so that sensitive data is protected, even inside a dataset * Automate sensitive discovery and tagging (like [PII](https://atlan.com/know/data-governance/automated-pii-classification/)) across systems * Propagate [policy configurations](https://docs.atlan.com/product/capabilities/governance/stewardship/how-tos/create-policies) to source systems like Snowflake using its [bidirectional tag sync](https://humansofdata.atlan.com/2023/09/snowflake-atlan-two-way-tag-sync/) and metadata context * Auditable logs and visibility as every role assignment, access event, and change request is tracked. You get visibility into who can see or edit what asset. --- ## Real stories from real customers: Consistent, automated policy enforcement at scale Modernized data stack and launched new products faster while safeguarding sensitive data "Austin Capital Bank has embraced Atlan as their Active Metadata Management solution to modernize their data stack and enhance data governance. Ian Bass, Head of Data & Analytics, highlighted, 'We needed a tool for data governance… an interface built on top of Snowflake to easily see who has access to what.' With Atlan, they launched new products with unprecedented speed while ensuring sensitive data is protected through advanced masking policies." Ian Bass, Head of Data & Analytics Austin Capital Bank 🎧 Listen to podcast: Austin Capital Bank From Data Chaos to Data Confidence 53 % less engineering workload and 20 % higher data-user satisfaction "Kiwi.com has transformed its data governance by consolidating thousands of data assets into 58 discoverable data products using Atlan. 'Atlan reduced our central engineering workload by 53 % and improved data user satisfaction by 20 %,' Kiwi.com shared. Atlan's intuitive interface streamlines access to essential information like ownership, contracts, and data quality issues, driving efficient governance across teams." Data Team Kiwi.com 🎧 Listen to podcast: How Kiwi.com Unified Its Stack with Atlan Let's help you build a robust data governance framework Book a Demo --- ## Ready to operationalize RBAC that scales with your data estate and teams? Role-Based Access Control (RBAC) is a foundational component of modern data governance. It offers a structured and repeatable way of managing access by aligning permissions with defined roles. As data volumes grow and teams scale, RBAC helps ensure that the right people have the right access at the right time. With platforms like Atlan, organizations can make RBAC implementation effective by using automated policy enforcement, column-level lineage, bidirectional tagging, and more. Book a Demo --- ## FAQs about RBAC in data governance ### 1. What is role-based data governance? Role‑based data governance means defining data access and management rules around roles instead of individuals. A role like "Analyst," "Steward," or "Admin" gets pre‑set permissions. Users assigned to those roles automatically inherit the permissions. ### 2. What are the three types of RBAC? There are three common sub‑types or styles when implementing Role‑Based Access Control: * **Simple RBAC**: Roles are flat and static; permissions assigned directly to roles, little to no hierarchy. * **Hierarchical RBAC**: Roles are arranged in a hierarchy where senior roles inherit permissions from junior roles. For example, a "Manager" role inherits all permissions of "Analyst." * **Constrained RBAC**: Adds separation of duties or constraints (for instance, one user cannot hold two conflicting roles) and supports rules to enforce those constraints. ### 3. What is an example of RBAC? Imagine a private equity firm using RBAC for its data governance: * A **Viewer** role only has read access to dashboards * An **Editor** role can modify investment data tables * A **Steward** role oversees data lineage and quality checks * An **Admin** role can assign other users to roles and manage permissions. When a new junior analyst joins, the firm assigns them the Editor role, giving them appropriate access without manually granting permissions per dataset. ### 4. What are the three levels of access controls? There are three widely recognized levels of access control, each defining how access decisions are made and enforced within an organization: 1. **Discretionary Access Control (DAC):** Access is at the discretion of the data owner. 2. **Attribute-Based Access Control (ABAC):** Access decisions use attributes (of user, resource, environment) via policy rules. 3. **Role-Based Access Control (RBAC):** Access is granted based on the user's role within the organization. ### 5. What is the difference between RBAC and ABAC? **RBAC (Role‑Based Access Control)** grants permissions based on a user's role. It's simpler to manage once roles are clearly defined, and it works well when organizational roles are stable and well understood. **ABAC (Attribute‑Based Access Control)** uses more granular rules. Access depends not just on role, but on attributes like user department, time of request, location, data classification, and environmental conditions. In practice, ABAC offers greater flexibility and finer control but can be more complex to set up and maintain. RBAC is easier to scale initially. Many organizations use a hybrid approach, combining RBAC for core roles and ABAC for exceptions or edge cases. ### 6. What are the three primary rules for RBAC? RBAC is governed by three fundamental rules that determine how permissions are assigned and enforced within a system: 1. **Role assignment:** A subject must be assigned a role to access resources. 2. **Role authorization:** Only authorized roles can be assigned to a subject. 3. **Permission authorization:** Subjects can perform only those actions authorized for their role. ---