Beginner LevelAuthentication & Authorization
What is Attribute-Based Access Control (ABAC) and how does it compare to RBAC?
❓ Interview Prompt: Compare dynamic ABAC policy evaluation vs static RBAC roles across Subject, Resource, Action, and Environment attributes.
While RBAC grants access based strictly on static user roles (e.g. 'Admin'), Attribute-Based Access Control (ABAC) evaluates dynamic boolean policy rules based on 4 attribute categories:
The 4 ABAC Attribute Categories:
1
Subject Attributes: User properties (department, clearance level, age, tenure).
2
Resource Attributes: Target data properties (classification level, document owner, project status).
3
Action Attributes: Requested operation (read, edit, delete, export).
4
Environment Attributes: Contextual signals (current time, client IP address, network threat level).
Example ABAC Policy:
"Allow access if 'Subject.department == Resource.department' AND 'Resource.isConfidential == false' AND 'Environment.time < 17:00'".
Code Implementation Example
typescript
interface AbacContext {
user: { department: string; clearanceLevel: number };
resource: { ownerDept: string; requiredClearance: number };
environment: { isBusinessHours: boolean };
}
function evaluateAbacPolicy(ctx: AbacContext): boolean {
return (
ctx.user.department === ctx.resource.ownerDept &&
ctx.user.clearanceLevel >= ctx.resource.requiredClearance &&
ctx.environment.isBusinessHours
);
}💡Evaluating dynamic Attribute-Based Access Control (ABAC) policy rules.
🎯 Interview Key Takeaway
ABAC evaluates dynamic boolean rules across Subject, Resource, Action, and Environment context attributes.
#ABAC#Authorization#Policies#Attributes#Beginner
Back to all Authentication & Authorization Questions→