Yes role based Access Control is available OOB, but not all ACL's are role based.
I would suggest you review a dev instance for clearer understanding.
ACL's
/nav_to.do?uri=%2Fsys_security_acl_list.do
Roles that are directly related to ACL's
/sys_security_acl_role_list.do?
Note: a role, or multiple roles, may be dfined in ACL script.
Where this occurs there will not be a record in sys_security_acl_role table.
Vendor documentation
https://docs.servicenow.com/bundle/quebec-platform-administration/page/administer/contextual-security/concept/access-control-rules.html
