> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/groups-departments-and-roles/user-roles-and-access-model.md).

# User roles and access model

SECUREpass controls access through several complementary mechanisms.

#### Role-based access control (RBAC)

Users are assigned roles aligned to job function — for example Database Administrator, Network Engineer or Third-Party Vendor. Roles bundle permissions, so access is granted once per role rather than per person. Roles can be assigned dynamically based on user attributes and organizational hierarchy.

#### Attribute-based access control (ABAC)

Access decisions can also consider attributes and context — time of day, geolocation, device type and risk score. A role might grant full access during business hours and restricted access outside them unless additional approval is obtained.

#### Time-bound and just-in-time access

Assignments can be permanent, time-bound with automatic expiry, or created just-in-time for a single task and removed afterwards, so no standing privilege accumulates.

#### Application-level roles

Each application onboarded to SECUREpass carries its own roles, with permissions of Read, Write, Admin or Custom, and its own authentication requirements per role. An administrator can be held to a stronger authentication standard than an ordinary user of the same application.

#### Administrative separation of duties

Super Admin and Admin are distinct. Admin entitlements are granular, so one administrator can be given user management without gaining policy or governance control. Administrative actions are recorded in the audit trail with the acting identity, timestamp and before/after values.