Role-Based Access (RBAC)

Role-based access control is the practice of granting permissions to roles (e.g., 'analyst', 'admin') rather than individuals — applied to AI employees the same way it applies to humans.

AI employees should not get blanket access to your stack. RBAC for AI means: an AI Bookkeeper sees finance data and not customer PII; an AI SDR sees CRM and not payroll. Same principle as human RBAC, more important because AI scales misuse.

Example

Acme assigns the AI Recruiter the 'recruiter' role: read access to applicant data, write to the ATS, no access to existing-employee compensation records.

How OpenLabor uses it

OpenLabor employees get role-scoped credentials per integration — least privilege by default.

Can the AI escalate its own privileges?

Not if you wire it correctly. Permissions live in your auth system; the AI only inherits what its role grants.

Related: guardrails, audit-trail, pii-redaction.

AI Labor Glossary