In a defense-in-depth strategy, the purpose of role-based access control (RBAC) is to ensure that users can access only the functions they need for their job. RBAC restricts system access to authorized users based on their roles within an organization, thereby minimizing potential security risks by limiting access to sensitive information and critical systems to only those employees who need it to perform their job duties. This approach enhances security by ensuring that users can perform only tasks relevant to their roles, reducing the likelihood of accidental or malicious misuse of access rights.