Role-based access control (RBAC) is the dominant access control pattern for customer portals. Instead of granting permissions per-user (which doesn’t scale), permissions are grouped into roles (e.g., “Admin,” “Manager,” “Viewer,” “Auditor”), and users are assigned one or more roles.
For multi-tenant B2B portals, RBAC often combines with tenant-scoped permissions — a user is an Admin within their organization but has no visibility into other organizations.
A practical portal role set might include account owner, billing administrator, contributor, viewer, and auditor. Keep roles tied to job responsibilities rather than individual exceptions; otherwise the model becomes difficult to test and review.
RBAC is different from attribute-based access control (ABAC), which evaluates properties such as account, region, data classification, or record ownership. Complex portals often use RBAC for broad capabilities and attributes for record-level decisions.
See Role-Based Access Control for implementation patterns.