Attribute-based access control
ABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
Attribute-based access control (ABAC) evaluates an access request using properties of the person acting, the object, the requested action and, where relevant, the environment. Rules define which combination permits access.
A document example
In a hypothetical portal, a rule permits reading only when the required reading permission exists, membership in the company the document belongs to is verified and the document is approved. A role name alone does not contain that entire decision.
The properties must come from reliable sources. A company identifier freely chosen in the browser proves no membership. Missing or outdated values also need defined handling. ABAC can incorporate roles and work with RBAC; the approach does not automatically make unclear rules correct.
Sources
Related terms
- Identity and access managementIAM combines management of digital identities with their access rights. Accounts, role changes and removal of old permissions belong together.
- Role-based access controlRBAC connects permissions to roles and assigns people to those roles. The data scope must be clear alongside the role name.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- WebAuthnWebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- Multi-factor authenticationMFA uses different types of authentication factors. Asking for the same factor type several times does not create a multi-factor check.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.