Qual é a diferença entre RBAC e ABAC?

No RBAC, as permissões dependem da função do utilizador na organização. Já no ABAC, dependem de atributos do utilizador, do documento e do contexto, como a localização, o dispositivo ou o momento do acesso. O RBAC é mais simples de gerir, enquanto o ABAC permite regras mais granulares, mas exige uma gestão mais detalhada.

Com que frequência devem ser revistas as permissões?

Pelo menos de seis em seis meses e sempre que alguém muda de função ou sai da organização. Nos perfis com acesso a dados sensíveis, como dados de saúde, a revisão deve ser mais frequente.

Os prestadores externos devem ter conta própria?

Sim. Cada utilizador deve ter credenciais individuais, com uma data de fim ligada à duração do contrato. Dessa forma, é possível saber quem realizou cada ação e retirar o acesso quando deixa de ser necessário.

Access permissions on document management platforms

Document management platforms have become essential for organising, storing and sharing information. These tools allow companies to manage their documents efficiently, centralise knowledge and improve collaboration between teams. However, with growing reliance on digital systems, there is also a need to define access permissions that protect sensitive data and documents against unauthorised access.

Permission-based access control is a fundamental approach to ensuring information security on document management platforms. This method allows organisations to define who can view, edit or share specific documents, so that each user only accesses the information needed for their role. Effective access control helps prevent data breaches, ensure compliance with data protection legislation and protect the company’s intellectual property.

This article covers the technical and practical foundations of permission-based access control on document management platforms. It analyses the different models, the benefits, implementation best practices and the challenges of this type of control. It also includes an example of profiles, a checklist and answers to frequently asked questions. The aim is to give professionals and users of document management platforms a comprehensive overview to help them secure their systems and protect company data.

The concept of permission-based access control

Permission-based access control is a security approach that regulates the level of access different users have within a document management platform. This type of control is essential to ensure that only authorised people can access, modify or share certain documents. As a result, it minimises the risk of information leaks and improper access.

Definition and importance of access permissions

Access control involves defining specific permissions that determine what each user can or cannot do within the platform. Generally, these permissions are based on criteria such as the user’s role, their position in the organisation’s hierarchy or their need to access certain documents to do their job. A well-implemented permission system allows organisations to strictly control who has access to sensitive information, protecting it against misuse.

Access control models

There are different access control models that can be applied on document management platforms:

Discretionary access control (DAC): In this model, document owners decide who can access their documents and what permissions those users have. It is a flexible model, but it can be prone to human error.
Role-based access control (RBAC): In the RBAC model, permissions are assigned based on users’ roles within the organisation. For example, all members of a given team may have the same access permissions to a specific set of documents. This model makes access management easier in large organisations, where assigning individual permissions would be impractical.
Attribute-based access control (ABAC): ABAC is a more dynamic model that considers a range of attributes (such as time, location and the device used, among others) to determine access permissions. This model is ideal for environments where access rules need to be more granular and contextual, providing greater flexibility in permission management.

Benefits of good access permission management

Well-structured permission management brings advantages that go beyond protection against improper access.

Stronger security

By strictly controlling who can view, edit or share documents, organisations reduce the risk of data breaches and unauthorised access. In addition, granular management makes it possible to define access based on criteria such as the user’s role, location or document classification.

Evidence for audits and inspections

Permission management makes it possible to document who has access to what, and why. As a result, the organisation can demonstrate in audits and inspections that it has adequate controls over sensitive information.

Operational efficiency

Centralised, automated permission control reduces the administrative burden of managing access manually, so IT and security teams can focus on more strategic tasks. At the same time, employees immediately get the access they need, without delays or errors.

Preventing internal fraud

Limiting access to sensitive documents to authorised users reduces the risk of information being manipulated by malicious employees. On the other hand, regular permission reviews make it possible to identify suspicious activity quickly.

Implementing permission-based access control

Implementing a permission-based access control system effectively requires a careful strategic and technical approach. The main steps for setting up a robust and efficient system are outlined below.

Identifying access needs

The first step in implementing an access control system is to identify access needs within the organisation. This involves mapping the different user profiles and determining which documents and features each group needs to do its work effectively. At this stage, it is essential to create a document inventory and classify documents according to the sensitivity of the information.

Setting up profiles, roles and access permissions

After identifying access needs, the next step is to set up user profiles and roles on the document management platform. Each profile should have permissions that strictly match the user’s needs. For example, a manager may need full access to certain documents, while an assistant may only need read permissions. This approach minimises the risk of improper access and protects document integrity. In more complex structures, granular controls can also restrict access to certain documents to specific devices or locations, or to a set period only.

Implementing security policies

Besides access permissions, it is crucial to implement security policies that reinforce access control. These policies include clear rules on who can modify permissions. They also define how changes are logged and monitored, and how access is revoked when a user changes role or leaves the organisation. In this way, these policies ensure consistent and secure management of access permissions over time. Wherever possible, these adjustments should be automated, so that permissions change when the user’s role changes.

Integration with other security systems

To increase security, it is advisable to integrate the access control system with other security tools. These include multi-factor authentication (MFA) and identity and access management (IAM) systems. These integrations ensure users are properly authenticated before accessing the platform. They also allow continuous access monitoring, thereby protecting the integrity and confidentiality of documents.

Monitoring and auditing access permissions

Continuous monitoring and regular auditing of access permissions are essential to keep the system secure over time. Audits help identify potential security gaps, misconfigured permissions or unauthorised access. In addition, monitoring tools can be configured to alert security administrators in real time to any suspicious or unusual access attempts. This enables a fast and effective response to potential threats.

User training and awareness

No access control system will be fully effective without user involvement and understanding. It is essential to provide adequate training so that users understand the importance of access permissions and know how to work within the system’s limits. Ongoing awareness of security best practices and the importance of keeping data protected also contributes to effective access control. In this way, users become aware of the risks and responsibilities associated with accessing information.

Implementation challenges and considerations

Although permission-based access control offers significant protection, its implementation can present challenges that should be handled with care.

Complexity in configuring access permissions

Configuring a permission system can be complex, especially in large organisations with many users and documents. The need to balance security with usability can lead to conflicts. For example, overly restrictive permissions hinder users’ work, while overly permissive ones create vulnerabilities. Complexity increases further with models such as ABAC, which require more granular and detailed permission management.

Ongoing maintenance of access permissions

Ongoing maintenance of the access control system is fundamental to keep permissions up to date and aligned with organisational changes. This includes regularly reviewing permissions, especially when users’ roles or responsibilities change. Furthermore, the system must adapt to new security threats, which may require frequent updates and adjustments to access policies. Without periodic reviews, unnecessary permissions build up. Former employees, or users who have changed roles, then keep access they should no longer have.

Regulatory compliance

Another important consideration is compliance with data protection legislation, such as the General Data Protection Regulation (GDPR). Organisations need to ensure that their access control system complies with these rules, which may require regular audits and compliance reports. Non-compliance can result in significant fines and damage to the company’s reputation.

Access permissions for external users

Many organisations need to grant document access to external parties, such as suppliers, partners or customers. Managing this external access poses additional challenges, because external users must only have the access they need without compromising internal security. Access control systems that allow granular permission management for external users are therefore essential to mitigate this risk.

Performance and scalability

On document management platforms with a large volume of users and documents, robust access control can affect system performance. It is important to ensure that the system is scalable and can handle more users and documents without compromising access speed or the effectiveness of access control operations. Technical solutions such as permission caching can help mitigate this problem.

User resistance

Users may see new controls as obstacles to their work. It is therefore advisable to clearly explain the benefits of good permission management and provide adequate training, so that everyone understands the importance of the new processes.

The principle of least privilege in practice

The principle of least privilege means that each user has only the access strictly necessary, and only for as long as necessary. In practice, this means starting with minimal permissions and adding only what is justified. For example, a technician who validates documents for one site does not need to see the company’s other sites, and a contractor should only see its own information. Thus, if an account is compromised, the impact is limited to a small portion of the data.

Practical example: Profiles on a contractor platform

On a contractor document management platform, access permissions have a direct impact on personal data protection. For example, medical fitness certificates should only be visible to those who need them. The following table shows a possible configuration:

Profile	Can view	Can do
Contractor	Its own documents and statuses	Upload and replace documents
Validator	Documents of assigned companies	Approve or reject with a reason
Site manager	Workers’ compliance status	View lists of cleared workers
Administrator	Platform configuration	Manage requirements and profiles

In this way, each person sees only what they need. The site manager, for example, can know who is cleared to work without accessing documents containing health data.

Access review checklist

Do all active users still need access?
Has access for employees who have left been removed?
Are there accounts shared by several people?
Are profiles with access to health data limited to what is necessary?
Do administrators use multi-factor authentication?

Frequently asked questions

What is the difference between RBAC and ABAC?

In RBAC, permissions depend on the user’s role in the organisation. In ABAC, by contrast, they depend on attributes of the user, the document and the context, such as location, device or time of access. RBAC is simpler to manage, whereas ABAC allows more granular rules but requires more detailed management.

How often should permissions be reviewed?

At least every six months, and whenever someone changes role or leaves the organisation. For profiles with access to sensitive data, such as health data, reviews should be more frequent.

Should external contractors have their own account?

Yes. Each user should have individual credentials, with an end date linked to the contract duration. This makes it possible to know who performed each action and to remove access when it is no longer needed.

Conclusion

Permission-based access control on document management platforms is an essential measure to ensure information security and compliance with data protection legislation. By implementing models such as RBAC or ABAC, organisations can ensure that only authorised people access their documents and keep security risks to a minimum.

However, effective access control requires a careful and continuous approach. This includes accurately identifying access needs, properly configuring profiles and roles, integrating with other security systems, and monitoring and auditing regularly. In addition, user training and awareness of the importance of document security are crucial for long-term success.

Despite the challenges involved, a well-implemented access control system offers an additional layer of protection. It contributes to the organisation’s overall security and to users’ confidence in how their most valuable documents are managed and protected.

To learn about the applicable data protection rules, consult Portugal’s data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

We don’t just implement platforms. We make sure they work.

Talk to the AISP team about implementation, administration and ongoing support for your operation after go-live, in any country, from administration centres in Portugal.