Software → Security
ABAC
An access-control model that evaluates policies using attributes of subjects, resources, actions, and environmental context.
What it is
Attribute-Based Access Control (ABAC) evaluates policies using facts about the subject, resource, requested action, and environment. A rule might allow an employee to read a document when the employee and document belong to the same region and the request originates from a managed device.
Attribute categories
- Subject: department, clearance, employment status, tenant, device trust.
- Resource: owner, sensitivity, region, lifecycle state, tenant.
- Action: read, update, approve, export, administer.
- Environment: time, network zone, risk score, authentication strength.
ABAC is expressive and can avoid role explosion, but policies are harder to reason about and test. Production implementations need authoritative attribute sources, deny-by-default behavior, policy versioning, decision logging, simulation, and clear precedence rules.