Skip to content

rbac-library.md

Latest commit

 

History

History
155 lines (120 loc) · 3.72 KB

rbac-library.md

File metadata and controls

155 lines (120 loc) · 3.72 KB
Raw

RBAC Library

Standardized access bundles — assign a role, not 20 permissions

The Idea

Instead of manually assigning each application and permission one by one, the RBAC Library defines role packages — pre-built bundles of access mapped to each role. Assigning a role assigns the entire package. Removing a role removes it.

This is what makes onboarding zero-touch and role changes a clean swap. The library is the catalog the entire lifecycle draws from.

How to Read a Role Package

Each package lists every entitlement a role receives. When the role is assigned, all of these are provisioned together. When removed, all are deprovisioned (unless retained by another active role).

Legal Roles

Senior Litigation Attorney

Senior Litigation Attorney
├── Outlook
├── Teams
├── Matter Management
├── SharePoint (Litigation)
├── Legal Research Platform
├── Document Management System (DMS)
└── VPN

Associate Attorney — Corporate

Associate Attorney (Corporate)
├── Outlook
├── Teams
├── Deal Room
├── SharePoint (Corporate)
├── Billing System
├── Document Management System (DMS)
└── VPN

Paralegal — Litigation

Paralegal (Litigation)
├── Outlook
├── Teams
├── Matter Management (limited)
├── Case Files (read)
├── SharePoint (Litigation)
└── Document Management System (DMS)

Business Operations Roles

HR Generalist

HR Generalist
├── Outlook
├── Teams
├── HRIS
├── Payroll (read)
├── Benefits Portal
└── Employee Files

Finance Analyst

Finance Analyst
├── Outlook
├── Teams
├── Financial Reporting System
├── Expense Management
├── ERP (Finance module)
└── SharePoint (Finance)

IT Systems Administrator

IT Systems Administrator
├── Outlook
├── Teams
├── Monitoring Tools
├── Server Admin (via PIM - JIT)
├── AD Management (via PIM - JIT)
└── VPN

External / Non-Employee Roles

Contractor (Time-Bound)

Contractor
├── Outlook (restricted)
├── Teams (guest)
├── Project-specific application(s)
├── SharePoint (project site only)
└── EXPIRES at EngagementEndDate

Vendor (Limited Remote Access)

Vendor
├── Vendor Portal
├── Specific system (scoped)
├── Remote access (monitored, time-bound)
└── EXPIRES at ContractEndDate

Package Composition Model

Role packages are built in layers, so common access is defined once and reused:

BaselinePackage (everyone)
   ├── Outlook
   ├── Teams
   ├── Intranet
   └── SSO

   + DepartmentPackage (e.g. Litigation, Finance, HR)

      + FunctionalPackage (e.g. Senior Attorney, Analyst)

         = Complete Role Package

A Senior Litigation Attorney's total access is: Baseline + Litigation-Department + Senior-Attorney-Functional

This layering means a change to the baseline (e.g., adding a new company-wide tool) updates every role at once, and department-level changes update everyone in that department — without touching individual users.

Why This Eliminates Manual Provisioning

Without RBAC Library With RBAC Library
Assign 20 permissions one by one Assign one role package
Inconsistent between hires Identical every time
Easy to forget an entitlement Complete by definition
Hard to remove cleanly Remove the package, done
No standard to audit against The package is the standard

The RBAC Library is the single source of truth for what each role should have — which makes provisioning fast, consistent, and auditable.