ABAC (Attribute-Based Access Control)
Attribute-based access control (ABAC) is an authorization model that evaluates access requests against attributes of the user, the resource, the action, and the environment. Instead of fixed roles, policies reference properties like department, clearance level, time of day, or data sensitivity to make dynamic access decisions.
Why It Matters
ABAC is more expressive than RBAC because policies can combine arbitrary attributes into conditions. "Allow read access to financial reports if the user's department is Finance and the data classification is Internal and the request is during business hours" is a natural ABAC policy.
For AI agent governance, ABAC's expressiveness maps well to the decision space. A policy might evaluate the agent's user, the action type (read, write, destructive), the target app's sensitivity classification, and the session's accumulated access path to make an authorization decision.
The tradeoff is complexity. ABAC policies are harder to audit, debug, and explain than RBAC role assignments. Policy engines like OPA/Rego and Cedar address this by providing structured, testable policy languages.