Role Based Access Control...

вот FAQ о том что такое RBAC - нота 290525.1

для иллюстрации первый вопрос из FAQ:

1. What is Role Based Access Control (RBAC)?

Role Based Access Control (RBAC) is an ANSI standard (ANSI INCITS 359-2004) supported by the National Institute of Standards & Technology (NIST). With the 11.5.10 release, Oracle User Management has implemented an RBAC model that closely follows this standard.

The RBAC standard supports the mapping of user access control based upon the role that the user plays within the organization rather than upon the user's individual identity. The benefits of implementing RBAC include:

* Reduced cost of administering user access
* Streamlined setup and implementation of security policies
* Structured user access control based upon users' job functions

The RBAC model augments the existing access control model in Oracle Applications by providing additional methods to organize your data security policies and existing function security (via roles). Security privileges in Oracle Applications have up to this point been managed on an individual user basis, with different types of privileges assigned to each user directly. For example, someone in a Support Agent position may have had to be assigned multiple responsibilities and several other types of access privileges in order to perform their job.

By leveraging the RBAC model, users will no longer need to be directly assigned the lower level permissions and responsibilities, as these can be implicitly inherited based upon the roles assigned to the user. Roles can now be defined to consolidate responsibilities and other roles through role inheritance, as well as lower level permissions (functions) and data security policies. This is accomplished through a one-time setup, where all the permissions are assigned to the role. In order to make a mass update in a production system a client only needs to change the permissions or role inheritance hierarchies defined for a role, then all of the users assigned to that role will instantly inherit the new permissions.