# Scalable RBAC for multitenant SaaS applications

Quickly create real-time role-based access management for your multi-tenant SaaS application.

## Multi-tenant role-based access control

Role-Based Access Control (RBAC) describes the practice of aggregating discrete application permissions into a small set of roles, and assigning those roles to users or groups. Multi-tenant SaaS applications must ensure that these roles are scoped to a particular tenant, or set of tenants.

Aserto provides out-of-the-box support for this scenario. Users or groups can be assigned roles scoped to a single tenant, a set of tenants, or across all tenants. If you support a resource hierarchy under the tenant structure (teams, projects, lists, or folders) you can easily extend your authorization model to cover fine-grained access.

## Go beyond simple roles

Create permissions within, and across each tenant. Grant access based on custom roles and group information.

## Enforce in real-time

Authorize using local user and resource data, within milliseconds and at 100% availability.

## Model your resource hierarchy

Base your policies on your unique domain model to enforce multi-tenant role-based access control that is tailored to your business.

Custom roles

Allow your customers to add custom roles that map to your permissions.

## Control more than access

Create policies that control access and influence frontend behavior, like hiding sections or fields.

## When RBAC isn't enough

Easily evolve your policy to use [resource ownership (ReBAC)](/content/use-cases/relationship-based-access-control-rebac/index.html) or [user and environmental attributes (ABAC)](/content/use-cases/attribute-based-access-control-abac/index.html).