{'fraction_non_alphanumeric': 0.027497708524289642, 'fraction_numerical': 0.0036663611365719525, 'mean_word_length': 5.312138728323699, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
RBAC in Practice

Since the Role-Based Access Control (RBAC) model was first introduced [2], it evolved into probably the most discussed and researched access control model in academia. It became the basis for hundreds of textbooks, research prototypes and theoretical studies. Specially after the NIST (National Institute of Standards and Technology) standard for RBAC [4] was officially approved by the American National Standards Institute [1], RBAC features also gained a lot of attention of high profile commercial products. Its basic feature, which decouples the assignment of users to permissions via roles (illustrated in Figure 1), together with additional features are claimed to allow an efficient management of permissions, an effective enforcement of the need-to-know principle, and a scalable assignment of permissions to users. However, it is unknown to what extent the efforts put into RBAC research and development make true their promise in practice. Are they really aligned with the needs of the practitioners? Requirement engineers should be the first to know the answer!