Comparison
Attribute-based access controlvsRole-based access control
Attribute-based access control
the rule is not "editors can edit" but "you can edit a document in your own team that is not locked".
Deciding access from attributes of the subject, resource, action and context rather than a static role. It expresses ownership and tenancy rules that RBAC cannot. It is harder to audit and harder to answer "who can access this", so it usually appears alongside roles rather than replacing them.
Full entry →Role-based access control
you assign the user a role and let the role carry the permissions, instead of granting each capability one at a time.
Granting permissions to roles and roles to users. It is simple to reason about and audit, and it covers most organisational needs. It struggles when permission depends on the specific record — ownership, tenancy, state — which is where people either add a role per customer or move to attribute-based rules.
Full entry →