Benchmarking Role-Based Access Control in Data Management Systems

Role-Based Access Control (RBAC) is a widely used method for controlling access to data in data management systems, offering a scalable approach to enforcing security policies. Despite its broad adoption, RBAC implementations vary significantly across different systems, leading to inconsistencies in performance. Currently, there is no standardized benchmark for evaluating RBAC performance. In this study, we propose a benchmark that focuses on two core components: the creation of role hierarchies with varying structures and the access to securable objects and role metadata through SQL queries. We evaluate three systems—PostgreSQL, MariaDB, and Snowflake—across on-premise and cloud deployments. Our findings reveal notable differences in RBAC performance, driven by I/O demand, caching behavior, and system architecture. These results highlight the diversity of RBAC implementations and the need for a systematic approach to evaluate RBAC at scale.