Security

A common approach to application security is role-based access control (RBAC). Under this system, an administrator assigns individuals to roles and then authorizes those roles to perform certain actions within the system. As we adopt immutable architectures, RBAC becomes more challenging. Requiring an administrator to assign roles and permissions reduces the autonomy of individual users. Consulting a single source of truth for those roles and permissions reduces the autonomy of client nodes. The access control model begins to work against the advantages that we fought so hard to achieve.