14 — Access Control
Attribute-Based Access Control (ABAC)
Decisions are expressions over attributes — not fixed roles or labels. The most expressive model.
Four attribute sources
- Subject: user_id, department, clearance, role, age, certification, training completed
- Object: resource_type, classification, owner, sensitivity, project_id
- Action: read / write / delete / approve / execute
- Environment: time, day, location (IP/GPS), device posture, threat level, network
Policy structure + two worked policies
# Generic rule
PERMIT if subject.attr OP value AND object.attr OP value
AND environment.attr OP value AND action ∈ allowed
# OP: ==, !=, <, >, ≤, ≥, ∈, ⊆, regex, ...
# Policy 1 — doctors read own-dept records on weekdays, business hours
PERMIT if subject.role == "doctor" AND subject.dept == object.dept
AND object.type == "medical_record" AND environment.time ∈ "07:00–19:00"
AND environment.day ∈ {Mon..Fri} AND action == "read"
# Policy 2 — managers approve ≤50k from corporate devices, deny externals
PERMIT if subject.role == "manager" AND object.type == "invoice"
AND object.amount ≤ 50000 AND environment.device == "managed"
AND environment.network != "external" AND action == "approve"
Theory — combining & verdicts
Multiple policies combine: deny-overrides (any Deny wins — safest), permit-overrides, first-applicable. PDP outputs one of:Permit / Deny / NotApplicable (no policy matched) / Indeterminate (missing attr / error)
PEP must fail closed: anything not explicitly Permitted is Denied.Decision flow — XACML architecture
PEP — Policy Enforcement Point. Fronts the resource; blocks until a decision arrives.
PIP — Policy Information Point. Gathers attributes (LDAP, HR DB, time, device posture).
PDP — Policy Decision Point. Evaluates policies → Permit / Deny / NotApplicable / Indeterminate.
PAP — Policy Administration Point. Authors/versions/manages the policy store.
PEP enforces the verdict — allows or blocks.
XACML flow: PEP intercepts, PDP decides, PIP provides attributes, PAP manages policies.
Strengths
- Fine-grained — single attribute combinations
- Dynamic — re-evaluated per request; no stale roles
- Composable — Boolean AND/OR/NOT
- Scalable — avoids RBAC role explosion
- Context-aware — time, location, posture
Standard
XACML (OASIS XML standard). Modern alternatives: Open Policy Agent (Rego), AWS IAM policies, Cedar.Exam one-liner
ABAC evaluates subject/object/action/environment attributes at request time via PEP→PDP (PIP supplies attrs, PAP manages) — most expressive of the four.