RBAC decouples "who can do what" from individual users by introducing roles as an intermediate layer: permissions are attached to a role (e.g. "billing-admin"), and users gain those permissions by being assigned that role. This makes access auditable and manageable at organizational scale — revoke a role once instead of hunting down every permission a departing employee individually accumulated.
Worked example: role-based access control assigns permissions to ROLES (admin, editor, viewer) and users to roles, so you manage access by role rather than per-user — the standard model for most apps. Gotcha: RBAC struggles with context-dependent rules (‘editors can edit only their own team’s docs’) — that is where ABAC (attribute-based) or per-resource policies come in; role explosion (a new role per permission combo) is the classic smell that you have outgrown pure roles.