A model for access control based on user roles. It restricts the functions a user can perform according to their assigned role. (Example: the functions available to a user may differ depending on the department they belong to.)