ABAC (Attribute-Based Access Control)

Overview

ABAC makes authorization decisions using attributes of users, resources, actions, and environment context.

Attribute Dimensions

• Subject attributes: department, clearance
• Resource attributes: data classification, owner
• Action attributes: read, update, delete
• Environment attributes: time, location, device posture

flowchart TD
    A[Request] --> B[Policy Engine]
    B --> C{Attributes Match Policy?}
    C -->|Yes| D[Allow]
    C -->|No| E[Deny]

Practical Example

{
  "policy": "allow read when user.department == resource.department and resource.classification != 'restricted'"
}

Production Example

Healthcare platforms often apply ABAC policies to restrict sensitive records by clinician role, care team membership, and emergency override rules.

Common Pitfalls

• Hard-to-audit policy sprawl
• Inconsistent attribute sources across systems
• High latency in policy evaluation path

Key Takeaways

• ABAC enables fine-grained dynamic authorization.
• Strong attribute governance is essential.
• Policy observability improves trust and debugging.