# ABAC

Record: `arch:attribute-based-access-control`
Kind: model
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: user, resource, context
Canonical: https://banes-lab.com/ontology#arch-attribute-based-access-control

## Repair

- Refactored by: Extract Policy, Add Policy Engine
- Detected by: duplicated attribute checks in handlers
- Violated by: complex access logic embedded in code
- Measured by: policy centralization
- Enforced by: [policy-as-code](https://banes-lab.com/records/arch/policy-as-code.md)

## requires

- [Attribute Definitions](https://banes-lab.com/records/lex/attribute-definitions.md)
- [Policy Engine](https://banes-lab.com/records/lex/policy-engine.md)

## reinforces

- [Fine-Grained Access Control](https://banes-lab.com/records/lex/fine-grained-access-control.md)

## enables

- [Context-Aware Authorization](https://banes-lab.com/records/lex/context-aware-authorization.md)

## conflicts-with

- [Hardcoded Rules](https://banes-lab.com/records/lex/hardcoded-rules.md)

## tensions-with

- [Policy Complexity](https://banes-lab.com/records/lex/policy-complexity.md)

## tensions

- [ABAC Policy Complexity](https://banes-lab.com/records/tension/abac-policy-complexity.md)