{
  "code": "ABAC",
  "collection": "architecture",
  "href": "https://banes-lab.com/ontology#architecture-attribute-based-access-control",
  "id": "attribute-based-access-control",
  "kind": "model",
  "layer": {
    "href": "https://banes-lab.com/ontology/schema#layer-security-core",
    "json": "https://banes-lab.com/json/records/layer/security-core",
    "label": "Security Core",
    "markdown": "https://banes-lab.com/records/layer/security-core.md",
    "ref": "layer:security-core"
  },
  "name": "Attribute-Based Access Control",
  "ref": "architecture:attribute-based-access-control",
  "relations": [
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-attribute-definitions",
          "json": "https://banes-lab.com/json/records/lexicon/attribute-definitions",
          "label": "Attribute Definitions",
          "markdown": "https://banes-lab.com/records/lexicon/attribute-definitions.md",
          "ref": "lexicon:attribute-definitions"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-policy-engine",
          "json": "https://banes-lab.com/json/records/lexicon/policy-engine",
          "label": "Policy Engine",
          "markdown": "https://banes-lab.com/records/lexicon/policy-engine.md",
          "ref": "lexicon:policy-engine"
        }
      ],
      "relation": "requires"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-fine-grained-access-control",
          "json": "https://banes-lab.com/json/records/lexicon/fine-grained-access-control",
          "label": "Fine-Grained Access Control",
          "markdown": "https://banes-lab.com/records/lexicon/fine-grained-access-control.md",
          "ref": "lexicon:fine-grained-access-control"
        }
      ],
      "relation": "reinforces"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-context-aware-authorization",
          "json": "https://banes-lab.com/json/records/lexicon/context-aware-authorization",
          "label": "Context-Aware Authorization",
          "markdown": "https://banes-lab.com/records/lexicon/context-aware-authorization.md",
          "ref": "lexicon:context-aware-authorization"
        }
      ],
      "relation": "enables"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-hardcoded-rules",
          "json": "https://banes-lab.com/json/records/lexicon/hardcoded-rules",
          "label": "Hardcoded Rules",
          "markdown": "https://banes-lab.com/records/lexicon/hardcoded-rules.md",
          "ref": "lexicon:hardcoded-rules"
        }
      ],
      "relation": "conflicts-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-policy-complexity",
          "json": "https://banes-lab.com/json/records/lexicon/policy-complexity",
          "label": "Policy Complexity",
          "markdown": "https://banes-lab.com/records/lexicon/policy-complexity.md",
          "ref": "lexicon:policy-complexity"
        }
      ],
      "relation": "tensions-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#tension-attribute-based-access-control-abac-policy-complexity",
          "json": "https://banes-lab.com/json/records/tension/attribute-based-access-control-abac-policy-complexity",
          "label": "Attribute-Based Access Control (ABAC) / Policy Complexity",
          "markdown": "https://banes-lab.com/records/tension/attribute-based-access-control-abac-policy-complexity.md",
          "ref": "tension:attribute-based-access-control-abac-policy-complexity"
        }
      ],
      "relation": "tensions"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-hardcoded-rules",
          "json": "https://banes-lab.com/json/records/lexicon/hardcoded-rules",
          "label": "Hardcoded Rules",
          "markdown": "https://banes-lab.com/records/lexicon/hardcoded-rules.md",
          "ref": "lexicon:hardcoded-rules"
        }
      ],
      "relation": "violated-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-policy-as-code",
          "json": "https://banes-lab.com/json/records/architecture/policy-as-code",
          "label": "Policy as Code",
          "markdown": "https://banes-lab.com/records/architecture/policy-as-code.md",
          "ref": "architecture:policy-as-code"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-policy-engine",
          "json": "https://banes-lab.com/json/records/lexicon/policy-engine",
          "label": "Policy Engine",
          "markdown": "https://banes-lab.com/records/lexicon/policy-engine.md",
          "ref": "lexicon:policy-engine"
        }
      ],
      "relation": "refactored-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#vocabulary-severity-contextual",
          "json": "https://banes-lab.com/json/records/vocabulary/severity-contextual",
          "label": "contextual",
          "markdown": "https://banes-lab.com/records/vocabulary/severity-contextual.md",
          "ref": "vocabulary:severity-contextual"
        }
      ],
      "relation": "severity"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/records/architecture-category/security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md",
          "ref": "architecture-category:security-privacy-compliance-governance"
        }
      ],
      "relation": "category"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-authorization-scattering",
          "json": "https://banes-lab.com/json/records/architecture/authorization-scattering",
          "label": "Authorization Scattering",
          "markdown": "https://banes-lab.com/records/architecture/authorization-scattering.md",
          "ref": "architecture:authorization-scattering"
        }
      ],
      "relation": "refactors"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-anti-patterns",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-anti-patterns",
          "label": "Anti-patterns",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md",
          "ref": "chapter:/ontology#architecture-category-anti-patterns"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-quality-attributes",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-quality-attributes",
          "label": "Quality Attributes",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-quality-attributes.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-quality-attributes"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-security-privacy-compliance",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-security-privacy-compliance",
          "label": "Security Privacy Compliance",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-security-privacy-compliance"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-vocabulary-severity",
          "json": "https://banes-lab.com/json/ontology/schema/the-vocabulary-severity",
          "label": "Severity levels",
          "markdown": "https://banes-lab.com/ontology/schema/the-vocabulary-severity.md",
          "ref": "chapter:/ontology/schema#the-vocabulary-severity"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-resolutions",
          "json": "https://banes-lab.com/json/ontology/schema/the-resolutions",
          "label": "The resolutions",
          "markdown": "https://banes-lab.com/ontology/schema/the-resolutions.md",
          "ref": "chapter:/ontology/schema#the-resolutions"
        }
      ],
      "relation": "linked-from"
    }
  ],
  "summary": "A conceptual representation of access control, Attribute-Based Access Control (ABAC), in which a policy decides from attributes of the subject, the resource and the environment.",
  "siblings": {
    "next": {
      "href": "https://banes-lab.com/ontology#architecture-input-validation",
      "json": "https://banes-lab.com/json/records/architecture/input-validation",
      "label": "Input Validation",
      "markdown": "https://banes-lab.com/records/architecture/input-validation.md",
      "ref": "architecture:input-validation"
    },
    "previous": {
      "href": "https://banes-lab.com/ontology#architecture-role-based-access-control",
      "json": "https://banes-lab.com/json/records/architecture/role-based-access-control",
      "label": "Role-Based Access Control (RBAC)",
      "markdown": "https://banes-lab.com/records/architecture/role-based-access-control.md",
      "ref": "architecture:role-based-access-control"
    }
  },
  "up": {
    "href": null,
    "json": "https://banes-lab.com/json/api/records/architecture",
    "label": "Architecture principles",
    "markdown": "https://banes-lab.com/api/records/architecture.md",
    "ref": "api:records/architecture"
  },
  "aliases": [
    "ABAC"
  ],
  "exemplar": {
    "after": "const decision = policy.evaluate({\n  subject: { id: user.id, department: user.department },\n  action: \"foo:update\",\n  resource: { ownerId: foo.ownerId, classification: foo.classification },\n  environment: { time: clock.now() },\n});\nif (!decision.allowed) throw new ForbiddenError();",
    "before": "if (user.role === \"editor\") return updateFoo(foo);",
    "lang": "ts",
    "medium": "code"
  },
  "formedBy": null,
  "scope": [
    "user",
    "resource",
    "context"
  ],
  "severity": "contextual"
}