> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Role-based access control overview
> Understand RBAC concepts and set up your policy in the Stytch Dashboard.
export const rbac = "Role-Based Access Control: An authorization model that manages access to resources within your application based on user roles.";
Stytch's RBAC model streamlines the management and enforcement of permissions for Consumer Authentication.
Configure your policy in the Stytch Dashboard.
Gate UI with RBAC checks from the client.
Authorize requests on your backend with sessions.authenticate.
## The RBAC Policy
An RBAC policy is a governing document that stores all access controls. It is the canonical source for RBAC authorizations within a Stytch Project, made up of three core concepts:
* **Resources**: entities within your application
* Examples: `documents`, `images`, `invoices`
* **Actions**: valid operations on a resource
* Examples: `create`, `read`, `update`, `delete`
* **Roles**: named collections of permissions
* Examples: `admin`, `editor`, `viewer`
### Resources
A Resource represents an entity in your application and is identified by a unique `resource_id` string you define.
### Actions
Actions are the allowed operations on a Resource. Actions can be standard CRUD operations or application-specific actions like `share`, `invite`, or `export`.
### Roles and permissions
A permission is a combination of a Resource and an Action (for example, `read` on `documents`). Roles are named sets of permissions. A Role can also include the wildcard action `*` to grant all actions for a Resource.
```js theme={null}
{
"role_id": "reader",
"permissions": [
{
"actions": ["read"],
"resource_id": "documents"
}
],
"description": "Readers can view documents."
}
```
## Set up your policy in the Dashboard
In the [RBAC Dashboard](https://stytch.com/dashboard/rbac), select **Resources** and **Create New Resource**. Define a `resource_id` and the list of actions allowed for that Resource.
For example, a `documents` Resource might support `create`, `update`, `delete`, and `download`.
Navigate to **Roles**. You’ll see a default Role:
* **`stytch_user`**: automatically assigned to all Users and grants basic permissions like updating their own name.
You can edit this Role or create custom Roles. When you add permissions to a Role, select a Resource and choose which actions it grants.
To grant all actions for a Resource, use the wildcard action `*`.
Add server-side authorization checks before honoring requests. See the [backend enforcement guide](/consumer-auth/authorization/enforcing-permissions).
Use the frontend SDKs to gate UI. See the [frontend authorization section](/consumer-auth/authorization/enforcing-permissions).
## What's next
* [Assign roles to users](/consumer-auth/authorization/assigning-roles-to-users)
* [Enforce permissions](/consumer-auth/authorization/enforcing-permissions)