RBAC vs ABAC
Two models for deciding who can do what: role-based access control with users, roles and permissions, its strengths and role explosion, attribute-based access control with policies over user, resource, action and context, relationship-based access (ReBAC), implementing checks in code, policy engines such as OPA and Cedar, and how to choose.
CodexBash, , 5 min read
Once a system knows who a user is (authentication), it must decide what they may do (authorisation). Can this support agent view this customer's orders? Can this teacher edit that course? Can this API key delete records? Two models dominate: role-based access control (RBAC), which grants permissions through roles, and attribute-based access control (ABAC), which evaluates policies over attributes of the user, the resource and the situation. This article explains both, a third model gaining popularity, how to implement checks well, and how to choose.
Sign in to read the rest
The whole 5 minute article is free with an account, along with every problem, lesson and tutorial. No card.