The set of attributes that define a job function and its associated set of access rights to the Security Service of Tivoli Kernel Services. A role definition, which consists of a membership filter and a capability set, defines the access rights that principals are allowed to have for a resource.