RBAC policies are typically defined based on __________, __________, and __________.

RBAC policies are typically defined based on user roles, data classification, and access permissions. User roles specify the responsibilities and privileges assigned to different users within the organization. Data classification categorizes data based on sensitivity levels, such as public, confidential, or restricted. Access permissions determine the actions and resources that each role can access or modify. By defining these factors, organizations can effectively manage access control and ensure data security compliance.