Attribute-based access control

Deciding access from attributes of the subject, resource, action and context rather than a static role. It expresses ownership and tenancy rules that RBAC cannot. It is harder to audit and harder to answer "who can access this", so it usually appears alongside roles rather than replacing them.