Why RBAC Isn’t Enough (and What ReBAC Gets Right)

If you’re an admin, you spend a lot of time trying to get people the access they need, without putting everything else at risk.

Too much access means security gaps. Too little means broken workflows and a flood of support tickets. Somewhere in the middle is the sweet spot: giving people just enough access to do their job.

That’s the promise of access control. And for a while, RBAC, or Role-Based Access Control, looked like the answer. Assign roles like “admin” or “viewer,” and let the system do the rest. But in practice, RBAC creates new problems.

The trouble with RBAC
RBAC works by assigning users to predefined roles, each with a fixed set of permissions. It’s tidy in theory. In reality, it breaks down as soon as you try to model a real-world organization.

You either end up with too few roles, forcing people to share broad access they don’t actually need, or you spin up dozens of custom roles to handle edge cases, some of which may be necessary today, but will change tomorrow. That’s a recipe for confusion, inconsistency, and role sprawl.

Want a contractor to see just one customer’s network? That’s a new role. Need to let someone view logs but not change anything? Another role. Month after month, year after year, it’s access control by duct tape, and it gets harder to manage with every new team, region, or project.

How ReBAC changes the model
ReBAC, or Relationship-Based Access Control, starts with a different assumption: that access should follow the relationships between people, devices, and resources. It’s a model designed to reflect how real organizations actually work.

Instead of granting blanket permissions to roles, ReBAC lets you define access based on where someone sits in a hierarchy, be that an organization or a set of networks. You can grant access to a domain and have that permission cascade naturally to the networks and devices inside it. No role cloning. No guesswork.

Here’s a simple comparison:
– RBAC says: Lennon is a “Network Admin,” so he can manage every network in the company.

– ReBAC says: Lennon is an admin on Domain A. That gives him control over the networks and devices in Domain A, but nothing in Domain B.

It also works in the other direction. A user with access to a specific network might need to see basic information about its parent domain or related devices. ReBAC allows that, too — without exposing more than necessary.

Is it really ReBAC? Here’s how to tell
There’s a lot of noise in access control marketing. Vendors talk endlessly about “fine-grained permissions” or “dynamic roles,” but that doesn’t mean they’re using ReBAC.

The real signs of ReBAC are in how the system handles access. Does it give someone access because of their connection to a specific team, device, or project? If one change automatically updates who can see or manage something, that’s a good indicator it’s true ReBAC. And if the system reflects how your organization actually works — with managers overseeing teams, or contractors only seeing what they need — then it’s probably ReBAC. If not, you’re likely still dealing with traditional RBAC, just with more settings and labels.

Built for complexity, not just control
ReBAC wasn’t dreamed up by vendors. It came out of real-world access problems inside companies like Google and Microsoft, where traditional role-based models fell apart under scale. The research behind it is open, mature, and proven.

The goal isn’t complexity. The goal is balance. ReBAC offers:
– The precision needed to secure sensitive systems
– The flexibility to reflect organizational structure
– A model that’s easier to understand and maintain over time

ZeroTier One for Enterprise now supports ReBAC
We’ve started implementing ReBAC inside ZeroTier One for Enterprise. Domains, networks, and devices are now linked to reflect real ownership and intent. You can build access policies that make sense, without creating a role for every possible exception.

Want to see it live? Join our webinar for a walkthrough, plus a look at what’s coming next. Want to learn more? Request a demo today.

ReBAC isn’t just an upgrade. It’s a better way to think about access.