What is Role-Based Access Control?
Role-Based Access Control (RBAC) is a security model that assigns permissions to roles rather than individual entities, and then assigns roles to users, agents, or processes — simplifying permission management and enforcing organisational policies at scale.
WHY IT MATTERS
RBAC is the standard access control model in enterprise systems. Instead of defining permissions per agent ('Agent-47 can call read_file and write_file'), you define permissions per role ('Editor role can call read_file and write_file') and assign roles to agents.
This simplifies management at scale. When you have 50 agents, changing the editor's tool access means updating one role definition rather than 50 individual YAML policies. New agents inherit appropriate tool permissions just by being assigned a role.
For MCP-based systems, RBAC maps naturally to YAML policy files. Each role gets its own policy file defining allowed tools and constraints. Agents are assigned to roles by configuring which policy file Intercept applies to their connection.
HOW POLICYLAYER USES THIS
Intercept implements RBAC through separate YAML policy files for each role. Define roles like 'reader' (read-only tools), 'editor' (read and write tools), or 'admin' (full tool access) — each as a YAML policy file. Assign agents to roles by routing their MCP connection through Intercept with the corresponding policy. Clean, scalable, and version-controllable.