IEC 62351 - Power Systems Communication Security 8:5: Part 8, clause 5: the RBAC process model and concepts (subjects, roles, permissions, separation, criteria for defining roles)

Role-based access control places subjects (people, software applications and automated systems) in roles and limits what they can reach to the resources that security policy deems necessary for each role, separating authorization from authentication and implementing least privilege in place of a super-user who has either every right or none; the model of ANSI INCITS 359 separates subjects, roles and permissions through subject-to-role assignment, role-to-permission mapping and permission definition (operations on objects), with policies and the reduction of complexity as the criteria for defining roles; local access, remote human access and remote automated access are in scope, while usernames and passwords, key management, the engineering and assignment of roles, CA selection and the security officer's tasks are out of scope.