Abstract: Disclosed herein is a system and method of using the same for risk-aware sessions in role based access control. Role Based Access Control (RBAC) has received considerable attention as a model of choice for simplified access control. Risk awareness in access control has emerged as an important research theme to mitigate risks involved when users exercise their privileges to access resources under different contexts such as accessing a sensitive file from work versus doing the same from home. In an embodiment, incorporated herein are “risks” in RBAC—in particular, in RBAC sessions. Described herein are systems comprising the RBAC model in conjunction with incorporating risk awareness in sessions where the risk is bounded by a session-based “risk-threshold.” Further described herein are systems comprised of frameworks of models for role activation and deactivation in a session based on this threshold.