---
title: "Confluent RBAC role bindings for Kafka topics"
description: "A role granting Write and Describe on orders does nothing until bound. Bind App:payments-svc to it with Confluent RBAC and the denied Kafka producer can write."
url: https://monedula.dev/kafka-simulator/scenarios/rbac-role-bindings/
---

# Confluent RBAC role bindings for Kafka topics

Scenario 10.5.2 · RBAC: role bindings. Authorization (ACLs & RBAC) · Intermediate · about 3 min · Apache Kafka 4.3 · Confluent Platform feature.

A role bundles grants once; binding a principal to it grants those permissions by inheritance - no per-principal ACL needed.

Run it: https://monedula.dev/kafka-simulator/playground/?scenario=10.5.2

## What you start with

RBAC layers role bindings over raw ACLs: a role bundles a set of grants once, and binding a principal to that role confers all of them by inheritance. This scenario binds a principal to a role and watches it gain the role's permissions without any per-principal ACL.

## Step by step

1. **Role defined · not bound** (t+0.000s): Authorization is on with no ACLs, but a role orders-writer is defined - a named bundle granting Write + Describe on the orders topic. A role on its own grants nothing; it must be bound to a principal. Producer p1 authenticates as App:payments-svc and is bound to nothing yet. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.2&t=0)
2. **Produce denied (no binding)** (t+1.000s): p1 produces to orders. App:payments-svc has no ACL and no role binding, so deny-by-default refuses the Write with TopicAuthorizationException - nothing is appended. The role exists, but until it is bound it confers no permission. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.2&t=1)
3. **Principal bound to orders-writer** (t+1.700s): App:payments-svc is bound to the orders-writer role. RBAC layers indirection over ACLs: the principal now inherits every grant the role carries (Write + Describe on orders) - without a single per-principal ACL being written. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.2&t=2)
4. **Authorized via inherited grant** (t+2.300s): The same producer now writes successfully - authorized purely by the role binding's inherited Write grant. One binding replaced the explicit ALLOW ACL of 10.5.1; binding more principals to the role would authorize them all at once. [Open at this step](https://monedula.dev/kafka-simulator/playground/?scenario=10.5.2&t=3)

## The takeaway

Roles make authorization scale - you manage permissions on a handful of roles instead of writing one ACL per principal, and a single binding grants or revokes the whole bundle.

## Further reading

- [Confluent documentation](https://docs.confluent.io/platform/current/security/rbac/index.html)

## Troubleshooting

- [TopicAuthorizationException in Kafka: causes and fixes](https://monedula.dev/kafka-simulator/troubleshooting/topic-authorization-failed/)