Policy-Based Access Control
Policy-Based Access Control, or PBAC, is an authorization approach in which decisions are driven by centrally managed policies evaluated by a decision engine.
- Acronym
- PBAC
- Synonym
- PBAC
Definition
Policy-Based Access Control, or PBAC, is an authorization model or architecture pattern in which access decisions are governed through formal policies evaluated outside or alongside application code. PBAC does not necessarily replace RBAC, ABAC, or ReBAC; rather, it often acts as the operating model used to express and enforce them consistently. Policies may reference roles, attributes, relationships, resource classifications, and contextual constraints, and they are typically evaluated by a policy decision point before being enforced by policy enforcement points. PBAC is attractive in environments that require central governance, consistency across services, and the ability to change authorization behavior without modifying each application independently.
Why it matters
PBAC helps organizations externalize authorization logic, improve consistency, and align access decisions with governance and audit expectations.
The Ariovis perspective
Roles are useful when they reflect stable business responsibilities and remain governable. Ariovis avoids forcing every exception into the role model and complements roles with controlled requests or contextual authorization.
Related services
Common pitfalls
- A frequent problem is implementing a policy engine without a disciplined policy lifecycle, test strategy, ownership model, or developer integration pattern.
Standards and protocols
- NIST SP 800-162
- OPA/Rego
- XACML
- Cedar
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.