The three rules of RBAC are:
1. Role assignments: Users are assigned a role.
2. Role authorization: Users’ roles must be authorized. Users cannot assign roles to themselves.
3. Permission authorization: Users can only use permissions assigned to their roles.