It has been assigned the UK certificate number PP001. The administrator assigns privileges to those roles, which may require finely grained operations to organization resources. Users are granted membership in the roles on the basis of their job responsibilities. As the user's job responsibilities change, which may be frequent, user membership in roles can be granted and revoked easily. As the organization inevitably changes, which generally is less frequent, roles can be modified easily through role hierarchies.
Role hierarchies allow new roles to inherit most of their definition from existing roles.
As the job changes, privileges are changed for the individual roles, which are relatively few, not for individual users, who may number in the hundreds or thousands. Role-based access control can implement sophisticated security policies that are difficult to implement otherwise. For example, separation of duties can be implemented with role-based access control, where, for example, routine administrative functions can be limited to one role and more powerful administrative functions can be reserved for an entirely different role. This of course is impossible in systems where there is a pre-defined and immutable superuser, and anyone occasionally needing access to more privileges than granted to ordinary users must necessarily be granted the highest level of privileges. Separation of duties can be either automatically enforced or procedurally supported depending on the implementation.