Who can open the school safe?

The school office has a safe. The head teacher can open it. The cleaner cannot. A new teacher can open it only on a weekday between 9 and 5.

Data needs the same care. A system must decide who may see marks, who may change them and who may delete them.

This lesson shows how a system decides.

Key words

Word	What it means	Example
Authentication	Proving who you are, for example with a password.	Log in
Authorisation	Deciding what a person may do after they log in.	May edit marks?
Platform	A system that uses data, such as a website or a phone app.	The college website and the college app
Permission	Something a person is allowed to do.	Read the class marks
Privilege	A strong permission. It gives extra power.	Delete a student
Access right	The right to read, change or delete one piece of data.	Read only
Rule	A condition that must be true, such as the time or the place.	Only 9 to 5
Role	A job title that carries a set of permissions.	Teacher
Benefit and drawback	A benefit is a good point. A drawback is a bad point.	Benefit: simple. Drawback: not flexible
RBAC	Role-based access control. Permissions belong to roles. People get roles.	All teachers can edit marks
RuBAC	Rule-based access control. A rule decides, for example the time or place.	Only from the school building

The cells students fill in are left blank in this preview.

Five words that are easy to mix up

Authorisation is the decision. A system checks: may this person do this?

A permission is one thing they may do. A privilege is a strong permission, such as deleting data. An access right says how much: read only, or read and change.

A rule adds a condition, for example "only in the office hours".

Data across platforms

The same data is often used on many platforms. Marks may be on the college website, in a phone app and in a report tool.

This has a benefit. The data is kept in one place, so every platform shows the same marks. It also has a drawback. There are more doors into the data, and every door must be guarded.

So the permission check must happen on every platform, every time.

RBAC: permissions belong to roles

Action	Student	Teacher	Admin
Read own marks	Yes	Yes	Yes
Read class marks	No	Yes	Yes
Edit marks	No	Yes	Yes
Delete a student	No	No	Yes

The cells students fill in are left blank in this preview.

How RBAC works

In RBAC you do not give permissions to each person. You give them to a role. Then you give people a role.

A new teacher joins. You give them the teacher role. They get every teacher permission at once. If a teacher leaves, you remove the role.

Try it: a role table

Code: python

permissions = {
    "student": ["read_own_marks"],
    "teacher": ["read_own_marks", "edit_marks"],
}

role = "student"
action = "edit_marks"
print(role, "may", action, "?", action in permissions[role])

# Change role to "teacher" and press Run again.

How RuBAC works

RuBAC checks a rule each time. The rule can use the time, the place or the device.

Here is an example rule. A teacher may edit marks only between 9 and 5. They must also be in the school building. The role may be right, but if the rule fails, the answer is no.

RBAC against RuBAC

	RBAC	RuBAC
Decides by	The role of the person	A rule: time, place, device
Benefit	Simple to set up. Easy to check who can do what.	Flexible. Stops risky use at strange times.
Drawback	Cannot say "only on weekdays". Too many roles are hard to manage.	Rules are hard to write and test. A wrong rule stops the right person.
Example	Teachers can edit marks.	Edit marks only from the school building.

The cells students fill in are left blank in this preview.