Organization-Based Access Control
Organization-Based Access Control, or ORBAC, is an authorization model that expresses permissions through organizational abstractions such as roles, activities, views, and contexts.
- Acronym
- OrBAC
- Synonym
- OrBAC
Definition
Organization-Based Access Control, or ORBAC, is a model designed to separate concrete permissions from higher-level organizational abstractions. Instead of assigning permissions directly, ORBAC introduces concepts such as role, activity, view, and context to express authorization in a way that is more aligned with policy intent and organizational structure. A role abstracts the subject, an activity abstracts the action, a view abstracts the resource set, and context constrains when the rule applies. ORBAC is conceptually valuable because it improves policy expressiveness and separation between policy design and technical implementation, although it is less commonly implemented explicitly in mainstream enterprise platforms than RBAC or ABAC.
Why it matters
ORBAC provides a useful conceptual framework for designing authorization models that reflect business structure and contextual policy logic.
The Ariovis perspective
Roles are useful when they reflect stable business responsibilities and remain governable. Ariovis avoids forcing every exception into the role model and complements roles with controlled requests or contextual authorization.
Related services
Common pitfalls
- A common challenge is that ORBAC can become difficult to operationalize if abstractions are elegant on paper but poorly mapped to actual systems, permissions, and ownership.
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.