> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/reference/roles-entitlements-and-the-access-model.md).

# Roles, entitlements and the access model

SECUREpass decides access using role-based and attribute-based control, and supports time-, location- and group-based conditions on top of both.

## RBAC and ABAC

**Role-based access control** bundles permissions into roles, and assigns roles to users or to groups. It is simple to reason about and simple to certify: a reviewer looks at a role rather than at a hundred individual permissions.

**Attribute-based access control** decides using attributes — department, location, device, time of day. It is finer-grained and context-aware, and it handles the cases RBAC cannot express without inventing a role for every combination.

Most working models use both: roles for the standing structure, attributes for the conditions.

## Admin roles

Built-in administrative roles scope what an administrator can see and do — Super Admin, Tenant Admin, Help Desk and Auditor among them. Custom admin roles can be defined and mapped to admin groups.

The point of the split is that administering identity should not require the ability to do everything. A help desk agent resetting passwords does not need to change security policy, and an auditor needs to read the audit trail without the ability to alter it.

## Application roles

Roles can also be defined per application — Admin, User, Read-Only — and mapped to users or groups. These roles flow to the application during single sign-on, so the application receives not just an authenticated identity but the role that identity holds within it.

This is what lets an application delegate its own authorisation to SECUREpass rather than maintaining a separate user list.

## Entitlements

Entitlements are the fine-grained rights inside applications and systems — the level below a role. SECUREpass discovers them, allows them to be assigned and reviewed, and normalises them into the Converged Identity Access Graph so that entitlements from different systems become comparable.

Normalisation is what makes cross-system governance possible. Without it, "admin on database X" and "owner in SaaS Y" are two unrelated strings; with it, they are both recognisably privileged access.

## Assigning roles

Roles can be assigned to users and groups individually or in bulk.

{% hint style="info" %}
**Assign to groups wherever you can.** Group-based assignment keeps access consistent, makes joiners and movers automatic, and is far easier to certify — a reviewer confirms one group rather than fifty individuals.
{% endhint %}

## Reviewing roles

Role assignments are reviewed and certified periodically through governance campaigns. A role that is never reviewed accumulates permissions, and the people holding it accumulate with it.