Attribute-Based Access Control

ABAC

Kind: model

Layer: Security Core

Aliases: ABAC

Record: architecture:attribute-based-access-control

Severity: contextual

Scope: user, resource, context

Canonical: Ontology

A conceptual representation of access control, Attribute-Based Access Control (ABAC), in which a policy decides from attributes of the subject, the resource and the environment.

Listed in Architecture principles, after Role-Based Access Control (RBAC) and before Input Validation.

Requires

• Attribute Definitions
• Policy Engine

Reinforces

• Fine-Grained Access Control

Enables

• Context-Aware Authorization

Conflicts with

• Hardcoded Rules

In tension with

• Policy Complexity

Tensions

• Attribute-Based Access Control (ABAC) / Policy Complexity

Violated by

• Hardcoded Rules

Refactored by

• Policy as Code
• Policy Engine

Severity

• contextual

Category

• Security / Privacy / Compliance / Governance

Refactors

• Authorization Scattering

Linked from

• Anti-patterns
• Quality Attributes
• Security Privacy Compliance
• Severity levels
• The resolutions