Attribute-Based Access Control (ABAC)

What is Attribute-Based Access Control (ABAC)?

Attribute-Based Access Control (ABAC) is an access control model that grants or denies access based on attributes evaluated against policies. These attributes describe the user (role, department), the resource (sensitivity, owner), the action, and the environment (device, location, time). Instead of fixed roles, ABAC makes dynamic, context-aware decisions, for example allowing access only from a managed device during business hours.

How ABAC works

• Define attributes for users, resources, actions, and environment.
• Write policies that combine those attributes into rules.
• At access time, an engine evaluates the request against the policies.
• Access is granted only if the conditions are met.
• Policies can adapt instantly without creating new roles.

ABAC vs RBAC

Compared with RBAC, ABAC is fine-grained and conditional, is context-aware (device, time, location), takes more setup effort to design policies, and scales well when access depends on many variables. RBAC is coarser and role-based, is not context-aware, takes less setup effort, and scales well when roles are stable and clear.

Examples and use cases

A healthcare SaaS allows a clinician to view patient records only if they belong to the same care unit, are on a managed device, and are accessing during a shift. RBAC alone cannot express that, so ABAC evaluates the attributes in real time. The cost is policy complexity, which is why many organizations combine RBAC for the baseline and ABAC for sensitive exceptions.

Related concepts

• RBAC vs ABAC access control models
• Identity governance
• Corma for security teams

FAQ

When should I use ABAC instead of RBAC?

Use ABAC when access decisions depend on context (device, location, time) or many variables that fixed roles cannot capture cleanly.

Is ABAC harder to implement than RBAC?

Generally yes. ABAC needs well-defined attributes and policies, but it removes role explosion and supports dynamic, zero-trust decisions.

Can RBAC and ABAC work together?

Yes. A common pattern uses RBAC for baseline access and ABAC for fine-grained, context-sensitive rules on top.

Request a demo