In RBAC, which element defines "what permissions" are granted?

Role Definition specifies the collection of permissions that are granted. It outlines the specific actions (e.g., read, write, delete) that can be performed on Azure resources. For example, the "Contributor" role definition allows full access to manage all resources, but not to assign roles. Security Principal is the "who" — the user, group, service principal, or managed identity that is granted permissions. Scope is the "where" — the level at which the permissions apply (e.g., subscription, resource group, or resource). Identity Provider is a service that manages user identities and provides authentication, but it doesn't define the permissions themselves.