This paper introduces a unified model for Role-Based Access Control (RBAC) developed by the National Institute of Standards and Technology (NIST). The model aims to standardize RBAC, which is a proven technology for large-scale authorization but lacks a common framework. The NIST model unifies ideas from prior RBAC models, commercial products, and research prototypes, focusing on aspects with available consensus. It is organized into four levels of increasing functional capabilities: Flat RBAC, Hierarchical RBAC, Constrained RBAC, and Symmetric RBAC. Each level adds new requirements, with Flat RBAC being the most basic and Symmetric RBAC the most advanced. The paper also discusses an alternate approach that combines Flat and Hierarchical RBAC in an ordered sequence with unordered features for constraints and symmetry. Additionally, it identifies important attributes of RBAC not included in the NIST model, some of which are not suitable for standardization, while others require further work and agreement. The goal is to provide a foundation for developing future standards and promoting the development of innovative authorization management tools.This paper introduces a unified model for Role-Based Access Control (RBAC) developed by the National Institute of Standards and Technology (NIST). The model aims to standardize RBAC, which is a proven technology for large-scale authorization but lacks a common framework. The NIST model unifies ideas from prior RBAC models, commercial products, and research prototypes, focusing on aspects with available consensus. It is organized into four levels of increasing functional capabilities: Flat RBAC, Hierarchical RBAC, Constrained RBAC, and Symmetric RBAC. Each level adds new requirements, with Flat RBAC being the most basic and Symmetric RBAC the most advanced. The paper also discusses an alternate approach that combines Flat and Hierarchical RBAC in an ordered sequence with unordered features for constraints and symmetry. Additionally, it identifies important attributes of RBAC not included in the NIST model, some of which are not suitable for standardization, while others require further work and agreement. The goal is to provide a foundation for developing future standards and promoting the development of innovative authorization management tools.