The core idea

Attach permissions to roles, not people.

RBAC groups permissions into named roles, then assigns roles to users. You manage a few roles instead of permissions per person.