Role-Based Access Control and Regulatory Compliance in Enterprise Systems: A Regulatory-Alignment Architecture

Abstract

Enterprises rely on role-based access control to govern who may perform which action within their systems, a model whose foundational formulation established roles, rather than individual users, as the unit through which permissions are assigned and managed (Sandhu, Coyne, Feinstein, & Youman, 1996), later refined into a formal reference standard specifying how roles, permissions, and constraints should interact (Ferraiolo, Sandhu, Gavrila, Kuhn, & Chandramouli, 2001). Three specific, well-documented limitations complicate a role-based model's ability to satisfy modern regulatory compliance requirements on its own. First, pure role-based access control struggles to express the fine-grained, context-dependent conditions many compliance regimes require, a limitation the attribute-based access control literature addresses by conditioning access decisions on attributes of the user, resource, and environment rather than role membership alone (Hu, Kuhn, Ferraiolo, & Voas, 2015). Second, satisfying regulatory requirements for separation of duties — ensuring no single role can both initiate and approve a sensitive transaction — requires enforcement logic that role assignment alone does not guarantee, a gap the workflow-security literature addresses directly (Botha & Eloff, 2001). Third, demonstrating compliance to a regulator requires accountability: a verifiable record of who accessed what, under what authority, and why, a requirement the information-accountability literature establishes as distinct from access control itself (Weitzner, Abelson, Berners-Lee, Feigenbaum, Hendler, & Sussman, 2008), made more consequential by data-protection regimes such as the European Union's General Data Protection Regulation, which impose specific, binding obligations on how personal data access is governed and documented (Hoofnagle, van der Sloot, & Zuiderveen Borgesius, 2019). This paper proposes RAMPART (Role-based Access Management for Policy-Aligned Regulatory Trust), an architecture in which a hybrid role-attribute modeling layer, a separation-of-duties enforcement layer, and a compliance accountability and audit layer are coordinated by a regulatory alignment controller that maps enforced access decisions directly to the specific regulatory obligations they satisfy. Following a design-science research approach, RAMPART is illustrated, not empirically validated, through a comparative capability table, an illustrative case scenario, and two illustrative figures, with every quantitative value explicitly labeled as an illustrative estimate rather than measured production data. The paper situates RAMPART against the literature on role-based access control, attribute-based access control, separation of duties in workflow systems, information accountability, data-protection regulation.