> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure Role-Based Access Control (RBAC)

Role-based access control allows you to configure the scopes that are contained within OAuth access tokens requested by client applications on behalf of users in order to access protected APIs/URLs. You create Access Management Roles and link them to scopes and users. Consider the following example:

example

You have created a health care API with the following scopes: `prescription:fill`, `prescription:view`, `prescription:refill`, `tests:book`, `test:results`, `tests:post`, `appointments:schedule`, `appointments:confirm`. Using this example, you want to allow the following access:

- A pharmacy access to view, fill, and refill prescriptions.
- Patients access to schedule and confirm appointments, request prescription refills and view test results.
- Hospital access to all scopes.

To enforce scope access based on user permissions, create Access Management Roles for the pharmacy, patients, and hospital, map the corresponding scopes to each role, and then assign these roles to your users.

## Role-Based Access Control

1. Click Menu icon **>** **Security > Resource Server**. The **Resource Server** page appears.

2. Select **RBAC**. The **Access Management Roles (Role-based Access Control**) page appears.

3. Click Circle Plus icon. The **Add Role** dialog box appears.

4. Enter a **Name** for the Access Management Role.

5. Enter a **Description** for the role.

6. Select the **Parent (Role to Extend)** from the drop-down list.

note
A role can inherit its scopes from another role (such as, a parent role). If a role extends a parent role, it will also be associated with all the scopes associated with the parent.

7. Select the **API/URL** the role can access from the drop-down list.

8. Select the **Scopes** the role can access.

9. Repeat the steps above to add additional APIs/URLs with scopes associated with this role.

10. Click **Add**.