Which of the following is a true statement regarding role$-$based access control?

Question $13$ options:

Access rights are first assigned to users. Roles are then associated with those access rights.

Access rights are first assigned to roles. User accounts are then associated with those access rights.

Access rights are first assigned to roles. User accounts are then associated with those roles.

Access rights are first assigned to users. Roles are then associated with those users.