Attribute-based Access Control

Attribute-based access control (ABAC) is an emergent permission model in which access decisions are made dynamically based on attributes of the agent, the resource, and the context. Unlike static role-based models, ABAC treats permission as a computation over a continuously changing field of attributes. The agent's location, the time of day, the sensitivity of the resource, the history of prior access — all become inputs to a decision function that is evaluated at the moment of request. This makes ABAC a genuinely complex adaptive mechanism: the permission boundary changes as the system state changes. The cost of this flexibility is opacity: when access is denied, it is often difficult to explain why, because the decision depends on many interacting variables. ABAC is the most sophisticated access control model and the most difficult to debug. See also: Policy-as-Code.