Ok.  I guess the difference is I would never suggest RBAC to be &quot;relatively simple&quot;.  There are so many considerations (are negative permissions required?  are there many to many required?  separation of duties?) that without making things explicit it&#x27;s hard to know what is meant by &quot;role&#x2F;permission based authorisation&quot;.