ABAC

Attribute-Based Access Control

Permissions based on attribute conditions -- more flexible than RBAC.

When you'd see it: Access-control design in larger or regulated systems, usually discussed as the more flexible alternative to RBAC.

Why it matters: ABAC grants access from attributes (role, department, location, time, data sensitivity) rather than fixed roles. It is more expressive than role-based access, and harder to audit.

Common mistakes: Reaching for ABAC when RBAC would do. The flexibility buys complexity, and over-engineered access rules become impossible to reason about.