A role-based access control method and system provide for receiving a request to provide access to a resource, identifying an identity associated with the request, classifying the URI into a permission that allows access to the resource, generating a graph representing the one or more granted permissions, and authorizing the request including traversing the graph to determine that the first permission is included in the one or more granted permissions.