Attribute-Based Access Control
Attribute-Based Access Control, or ABAC, is an authorization model that makes decisions based on attributes of the subject, resource, action, and environment.
- Acronym
- ABAC
- Synonym
- ABAC
Definition
Attribute-Based Access Control, or ABAC, is an authorization model in which access decisions are derived from evaluating attributes rather than relying only on static role membership. Subject attributes may include department, clearance, country, employment status, risk level, or device trust. Resource attributes may include classification, owner, business unit, confidentiality level, workflow state, or region. Environmental attributes can include time, network, location, session conditions, or transaction context. ABAC is powerful for dynamic and fine-grained authorization because it can express access rules such as who may access which data under which circumstances. Its success, however, depends on attribute quality, governance, consistency, and policy design discipline.
Why it matters
ABAC is valuable when authorization must adapt to context, data sensitivity, ownership, geography, or dynamic business rules.
The Ariovis perspective
Roles are useful when they reflect stable business responsibilities and remain governable. Ariovis avoids forcing every exception into the role model and complements roles with controlled requests or contextual authorization.
Related services
Common pitfalls
- A major pitfall is adopting ABAC without trustworthy attribute sources, clear semantics, data quality controls, or testable policy design.
Standards and protocols
- NIST SP 800-162
- XACML
- OPA/Rego
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.