ABAC
Attribute-Based Access Control. Access decisions are made by evaluating attributes of the subject, resource, action, and environment against policy. Flexible but harder to audit than RBAC. Often expressed in XACML or modern policy languages like Rego.
ABAC earns its complexity when access depends on data the role cannot express: clearance level, project membership, time of day, device posture, or record ownership. The cost is auditability. A reviewer can read a role assignment; they cannot easily answer "who can read this record" from a policy file without evaluating it. Most mature deployments use roles for the coarse grant and attributes for the fine-grained condition rather than choosing one.
See also: RBAC vs ABAC vs ReBAC, ReBAC, fine-grained authorization, authorization vendors
Related on Start with Identity
- GlossaryRBAC
Role-Based Access Control. Permissions are bundled into roles, users are assigned roles. Simple to understand and audit, but role explosion is a common failure
- GlossaryRole Mining
Analyzing existing access to discover sensible roles, reducing role explosion and cleaning up entitlements. A common step in rolling out or fixing RBAC. Role mi
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GuideImplementing Attribute-Based Access Control (ABAC): A Practical Guide
Design and deploy attribute-based access control with policy engines, XACML, dynamic authorization, and practical guidance on when ABAC beats RBAC.