Guide to Attribute Based Access Control definition and considerations
Defines ABAC’s terms, policy model, enterprise considerations, and relationship to role-based access control without tying the model to a vendor.
Permission engines · Learning path
How should a permission engine model authorization?
A path through role-based, attribute-based, and relationship-based authorization, then the policy decision API that separates evaluation from enforcement.
Engineers comparing authorization models or designing a policy decision point for human, service, and agent identities.
- 3
- stages
- 3
- selected readings
- 01
Stage 1
Understand attribute-based decisions
Explain how subject, object, action, and environment attributes form a policy decision and where ABAC differs from role assignment.
- 02
Stage 2
Understand relationship-based authorization at scale
Explain object relations, usersets, group nesting, consistency tokens, graph evaluation, and the latency and availability constraints of global authorization.
Zanzibar: Google’s consistent, global authorization system
The foundational system paper behind modern ReBAC engines, covering the relation model, tuple storage, consistency, distributed evaluation, and production scale.
- 03
Stage 3
Separate policy decisions from enforcement
Explain the policy decision point, policy enforcement point, access evaluation request, batch evaluation, search, and decision metadata.
Authorization API 1.0
Defines a model-neutral API between applications and authorization systems, including evaluation, batch evaluation, search, context, and decision responses.