1. A role-based access control system, comprising: a role definition system for defining roles to be sets of permissions on individual resources thus forming role instances, respectively; a super role definition system for defining at least one super role by assigning at least one set of role instances to at least one group and assigning the at least one group to the at least one super role, wherein each super role is modified by adding or removing the role instances from the at least one group, and wherein each super role is nested according to a plurality of properties including a name, a parent role, the set of role instances, and an externalisation state; and a super role assignment system for assigning a user or a user group to the at least one super role.