Hierarchical Role-Based Access Control Architecture for CRM/ERM Systems with Complex Data Topologies

Abstract

This paper proposes an advanced access management architecture designed for Customer Relationship Management (CRM) and Enterprise Resource Planning (ERM) systems that manage data within complex hierarchies. Recognizing the limitations of traditional flat RBAC models in providing object-level security, the architecture introduces dedicated entities for Groups (G), Hierarchical Nodes (O), and a specialized Permission Assignment (PA) mechanism. This extension enables dynamic access decisions based on the intersection of a user's role, group membership, and the target object's position in the hierarchy. The model is characterized by high scalability ) and relies on permission aggregation via union. Key findings highlight the model’s effective balance between fine-grained control and administrative efficiency, while acknowledging the inherent complexity in evaluation and the need for strict governance via the Privilege Escalation (PE) permission.