1. A data processing system for role-based access control management for multiple heterogeneous application components comprising: a processor, at least one business role descriptor associating a business role with a plurality of different application roles, identified within a role list, for corresponding, disparate application components; at least one access control policy associating a user with said business role; and, policy deployment logic executing on the processor and configured to process said access control policy to assign said user to said different application roles in said disparate application components, identify, within said role list, a nested business role associated with said business role and assign said user to additional application roles associated with said nested business role.