Abstract: The subject disclosure is directed towards resource sharing and/or isolation in a role based access (RBA) system. A resource may be associated with an owner, via an owner property, which provides isolation by enforcing exclusive access to that resource by the owner (unless the owner chooses to share). Sharing is provided by allowing the owner to identify, in a GrantedTo list, selected receiving user(s) or user role(s) that can have shared access. Also described is administrator-level control over the ability to share resources and/or receive shared resources, e.g., an administrator selects whether a resource owner is permitted to share resources and/or whether receiving users/user roles are permitted to receive shared resources.