# Access control and RBAC > Access control decides whether a caller may perform an action on a resource. Role-based access control (RBAC) groups permissions into roles such as viewer, editor, and admin, making access easier to manage. In system design interviews, the hard part is enforcing those rules consistently across services, caches, search results, and shared resources. Source: https://sysround.com/concepts/access-control Updated: 2026-11-05 ## How access control and rbac works Separate authentication from authorization: authentication establishes who the caller is; authorization decides what that caller may do. Model a decision as authorize(subject, action, resource, context), and deny access unless a rule explicitly allows it. In RBAC, roles contain permissions, and users or groups receive role assignments within a scope. For example, an editor role might include document.read and document.update, while an assignment gives Alice that role only in workspace W1. Store roles, role permissions, and scoped role assignments rather than a single global role field on each user. Check permissions on the server for every protected operation. A gateway can validate identity and reject broad categories of requests, but the service handling a document must check access to that specific document. Derive the caller from trusted authentication data and validate the resource's tenant; do not trust a client-supplied tenant ID by itself. Use resource-specific grants when sharing does not fit workspace-wide roles. An access control list (ACL) can grant Bob viewer access to one document. Attribute-based access control (ABAC) evaluates rules using subject, resource, and request attributes, such as allowing edits only when the caller's department matches the document's department. These approaches can complement RBAC. Make permission changes part of the design. Cached decisions and roles embedded in tokens can remain valid after revocation, so define an acceptable delay and choose expiration, invalidation, or authoritative checks accordingly. Filter search results before exposing titles or snippets, recheck long-lived subscriptions, and coordinate sensitive writes with permission changes when revocation must prevent concurrent actions. ## Worked example: Workspace roles with bounded sharing revocation A document service has 100 workspaces and three roles: viewer, editor, and admin. Alice is an editor in workspace W7, not across all workspaces. Each read checks the document's workspace and Alice's scoped assignment; a document ACL can also grant a guest read access. Suppose permission removal must block new reads within 30 seconds. Cached allows expire within 20 seconds without stale serving, and download URLs expire within 10 seconds. URL issuance requires a valid authorization decision, so an issuance just before cache expiry still fits the bound. Sensitive writes check permissions transactionally with the update. Already downloaded content cannot be recalled. ## Trade-offs - **Simple administration versus role explosion.** RBAC makes common job responsibilities easy to manage, but creating a role for every resource and exception produces an unmanageable role catalog. - **RBAC predictability versus ABAC flexibility.** ABAC handles contextual rules without many specialized roles, but attribute freshness, policy testing, and explaining decisions become harder. - **Fast checks versus timely revocation.** Caching authorization decisions reduces latency and dependency load, but stale allows can expose data until they expire or are reliably invalidated. - **Central policy versus runtime dependency.** A shared authorization service improves consistency, but remote checks add latency and require an explicit failure policy, usually denying protected operations when no trustworthy decision is available. - **Inherited permissions versus move complexity.** Folder or page-tree inheritance simplifies sharing, but moving a subtree can change access to many descendants and invalidate cached decisions. - **Strong revocation versus coordination cost.** Preventing writes after a concurrent revocation may require transactional checks or version-based conditional writes rather than a separate check followed by an unguarded update. ## When to use it in a system design interview - The product has workspaces, organizations, or tenants with viewer, editor, owner, or admin responsibilities. - Users can share documents, folders, albums, or pages with individuals or groups. - Search, caches, or CDNs serve private content whose visibility can change. - Access depends on context such as department, resource classification, or an active trip assignment, suggesting ABAC alongside roles. - The interviewer asks what happens when someone loses access while a token, download link, or live connection is still active. ## How to bring it up in the interview - Start with concrete actions and scopes: who may read, edit, share, delete, or administer which resources? Interviewers will probe whether a workspace admin is accidentally treated as a global admin. - Sketch the authorization data model and one request path, including the trusted identity, resource lookup, tenant boundary, and final permission check. - Choose RBAC for stable responsibilities, then explain where resource grants or attribute rules are needed instead of forcing every exception into another role. - State the revocation requirement explicitly, such as 'new reads must be denied within 30 seconds,' then defend token lifetimes, cache behavior, and long-lived connection checks against it. - Explain failure and race behavior: what happens if the policy service is unavailable, a folder moves during a read, or permission is revoked during a write? Include audit records for permission changes and privileged actions. ## Common mistakes - Treating login, a valid JWT, or a hidden UI button as proof that an operation is authorized. - Using global roles without tenant or resource scope, allowing privileges to cross ownership boundaries. - Checking authorization only at the API gateway and missing object-level checks, background exports, or direct object-storage downloads. - Putting mutable roles in long-lived tokens and assuming logout or a database update immediately revokes them. - Returning private search snippets before checking access, or assuming an expired sharing grant also revokes already issued download URLs. ## Interview questions where it comes up - [Design Facebook post search](https://sysround.com/questions/design-facebook-post-search): Permission-aware retrieval must prevent stale indexes from exposing private posts, titles, or snippets after visibility changes. - [Design Dropbox or Google Drive](https://sysround.com/questions/design-dropbox): Shared subtree permissions, ownership boundaries, moves, and revocation determine which files each client may read or synchronize. - [Design Wikipedia or Notion](https://sysround.com/questions/design-wikipedia): Private revisions and inherited page permissions must remain protected across caches and page-tree moves. - [Design Google Photos](https://sysround.com/questions/design-google-photos): Album sharing requires authorization for private media delivery and a clear revocation bound for issued download links. - [Design an ETA and live location sharing service](https://sysround.com/questions/design-eta-service): Live location access must be scoped to a trip and reevaluated when assignments change or the trip ends. ## FAQ ### What is role-based access control (RBAC)? RBAC assigns permissions to roles and assigns those roles to users or groups. For example, a workspace editor may read and update documents, while a viewer may only read them. Role assignments should include their scope so that access to one workspace does not imply access to every workspace. ### What is the difference between RBAC and ABAC? RBAC bases access on assigned roles; ABAC evaluates rules over attributes of the caller, resource, and request context. RBAC fits stable responsibilities, while ABAC fits conditions such as matching departments or an active assignment. A system can combine them, requiring both an editor role and a resource-specific condition. ### How do you revoke access when permissions are cached? First define the maximum acceptable revocation delay, then account for every cached allow, token, download URL, and live subscription. Expiration bounds staleness; invalidation can speed up revocation but needs reliable delivery or a fallback bound. Operations requiring immediate revocation need authoritative checks and coordination with concurrent permission changes. ## Related concepts - [Multi-tenancy](https://sysround.com/concepts/multi-tenancy) - [JWT](https://sysround.com/concepts/jwt) - [Cache invalidation](https://sysround.com/concepts/cache-invalidation) - [Audit logs](https://sysround.com/concepts/audit-logs) --- SysRound (https://sysround.com) is an AI practice tool for system design interviews: a voice or typed AI interviewer, a shared whiteboard, then feedback on every skill and a model answer. Its feedback is AI-generated and can be wrong.