attribute-based access control
also: ABAC, attribute-based security, policy-based access control
A security model that grants or denies access to resources based on attributes (properties) of users, resources, environments, and actions, rather than fixed roles or identity alone.
Attribute-based access control (ABAC) evaluates multiple contextual attributes when deciding whether to permit an action. Instead of assigning a user to a role with fixed permissions, ABAC applies dynamic policy rules that consider who the user is, what they're accessing, when they're accessing it, and under what conditions.
Attributes can include user properties (department, clearance level, location), resource properties (classification, owner, type), and environmental factors (time of day, network location, encryption status). A policy rule might state: "Allow read access to financial documents if (user.department == 'finance') AND (request.time between 9am–5pm) AND (connection.encrypted == true)."
ABAC is more flexible than role-based access control (RBAC) but more complex to implement and manage. Linux systems use ABAC concepts in SELinux contexts (user, role, type, level) and through tools like Casbin and policy engines in containerized environments.