Policy-Based Access Control

Policy-Based Access Control, or PBAC, is an authorization model or architecture pattern in which access decisions are governed through formal policies evaluated outside or alongside application code. PBAC does not necessarily replace RBAC, ABAC, or ReBAC; rather, it often acts as the operating model used to express and enforce them consistently. Policies may reference roles, attributes, relationships, resource classifications, and contextual constraints, and they are typically evaluated by a policy decision point before being enforced by policy enforcement points. PBAC is attractive in environments that require central governance, consistency across services, and the ability to change authorization behavior without modifying each application independently. Expressed as declarative policies evaluated at decision time rather than hardcoded permission checks, PBAC supports broad use-case coverage, fine-grained access and real-time changes in authorization behaviour, but it requires solid IAM maturity and clear business modelling.