TBAC (Task-Based Access Control)
Task-based access control (TBAC) is an authorization model in which the task, not the role or attribute, is the unit of authorization. Permissions are synthesized just-in-time for each task and revoked on completion, scoping access to the lifecycle of a specific piece of work.
Why It Matters
RBAC was designed for a world where humans occupy stable roles. An accountant has accountant permissions, and those permissions remain constant between quarterly access reviews. AI agents break this model because their tasks change continuously.
TBAC treats the task as the authorization boundary. When an agent begins a task, the system determines what permissions the task requires and grants them. When the task completes, those permissions are revoked.
The concept has academic origins (Fleming et al., Cisco research) but has found practical expression in agent governance architectures where session-scoped permissions are the default.