Q22: Compare Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC).
- RBAC (Role-Based Access Control): Assigns permissions to explicit roles (e.g.,
Admin,Editor,Viewer). Users are assigned roles, and authorization logic checks if the user possesses the required role to access a route (hasRole('ADMIN')). - ABAC (Attribute-Based Access Control): Evaluates dynamic rules combining subject attributes (user role, department), resource attributes (owner ID, sensitivity classification), and environmental context (ip_address, time_of_day, device_type).
RBAC vs ABAC
Flexibility:
Static Role Checks vs Dynamic Policy ExpressionsRBAC checks fixed roles; ABAC evaluates dynamic contextual conditions.
Complexity:
Simple to Implement vs Requires Policy EngineRBAC uses straightforward role lists; ABAC requires engines like Open Policy Agent (OPA).
Granularity:
Coarse-Grained vs Fine-Grained Contextual ControlABAC supports policies like 'Allow editing only during business hours if user is record owner'.
Key Takeaways
- RBAC is ideal for straightforward coarse-grained role management.
- ABAC provides dynamic context-aware authorization policies across complex enterprise domain models.