DataTerminology.comNEW
Also known as: ABAC
An authorization model granting access based on policies that evaluate attributes of users, resources, actions, and environment.
DESCRIPTION
ABAC evaluates attributes and policies to decide authorization dynamically, enabling fine-grained, context-aware access. It scales better than static role assignments and supports complex conditions. Policies can be expressed with standards like XACML or custom engines. ABAC is widely used in cloud IAM, databases, and microservices. Proper attribute governance, policy testing, and auditing are critical for correctness.
ALTERNATIVE DEFINITIONS
NIST
Attribute Based Access Control (ABAC) is an access control paradigm whereby access rights are granted to users through the use of policies which combine attributes together.
Defines ABAC as a policy-driven paradigm combining attributes.
Wikipedia
Attribute-based access control (ABAC) is a generalized form of access control that uses attributes rather than roles to determine access.
Contrasts attribute-centric control with role-centric approaches.
AWS
Attribute-based access control (ABAC) is an authorization strategy that defines permissions based on tags attached to users and AWS resources.
Shows practical ABAC using tags in cloud IAM.
RELATED TERMS
Policy-Based Access Control XACML IAM Fine-Grained Access Control Open Policy Agent Access Control List Contextual Access
COMPETING TERMS
RELATIONS
- Broader: Access Control Fine-Grained Access Control Policy-Based Access Control
- Conforms to: XACML
KNOWLEDGE AREAS
Data Security Data Management Cloud Software Engineering
TARGET AUDIENCE
Software Developer DevOps Engineer Cloud Architect Data Engineer Data Architect Chief Technology Officer Chief Information Officer
EXTERNAL SOURCES
- Wikipedia - Attribute-based access control
- NIST - Official ABAC standard guidance
- AWS - ABAC in AWS IAM
- Open Policy Agent - Policy engine for ABAC/PBAC
TOP QUESTIONS
Why adopt Attribute-Based Access Control over RBAC?
ABAC offers dynamic, fine-grained policies that scale with context and attributes, reducing role explosion.
Category: Opinion
What attributes matter in ABAC?
User, resource, action, and environmental attributes such as department, sensitivity, time, and location commonly drive decisions.
Category: Example
How are ABAC policies expressed?
Using policy languages like XACML or engines like OPA (Rego), often evaluated at runtime.
Category: Management
What are common ABAC pitfalls?
Poor attribute governance, conflicting policies, and lack of auditing can cause incorrect authorizations and complexity.
Category: Mistakes
How does ABAC integrate with Row-Level Security?
Database RLS can evaluate session attributes, effectively implementing ABAC at the data layer.
Category: Example
Is ABAC suitable for cloud environments?
Yes, cloud IAM widely uses attributes (tags, conditions) for scalable, context-aware authorization.
Category: Relevancy
What is the biggest misunderstanding about ABAC?
That ABAC replaces roles entirely; roles can coexist as attributes or coarse entitlements.
Category: Misunderstanding
How do you test ABAC policies?
Set up policy unit tests, simulate attributes, and run coverage checks to validate edge cases.
Category: Management
What standards support ABAC?
NIST SP 800-162 and OASIS XACML define models and policy formats for ABAC deployments.
Category: Requirements