ABAC

Definitions

1. Attribute-Based Access Control -- an authorization model where access decisions are based on attributes of the user (department, clearance), resource (classification, owner), action (read, delete), and environment (time, location, IP). More flexible than RBAC for complex policies like 'managers can approve expenses under $10K in their own department during business hours.'

   In plain English: Controlling access based on multiple attributes (who, what, when, where) instead of just roles.

   Example: "ABAC policy: allow if user.department == resource.department AND user.role >= 'manager' AND action == 'approve' AND amount < 10000."

Related Terms

• Authorization
• Capability
• IDOR
• RBAC
• Fail-Closed
• Fail-Safe Default
• Policy Engine
• Role-Based Access Control
• Permission
• Role
• Attribute-Based Access Control
• Data Lake Security
• FedRAMP
• Management Plane Security
• MPA
• Permission Model
• Principle of Least Privilege
• Resource Access
• Authorization Flow