Attribute-Based Access Control

NIST’s model evaluates requested operations using subject and object attributes, environmental conditions and policy. A rule permitting qualified staff in one department to read a record category can combine qualification, department, category and action rather than one employee label.

Attributes commonly use name–value pairs, but field names alone do not establish meaning. Job role, resource ownership and current time differ, and organizations need shared definitions or explicit mappings before treating their values as equivalent.

References: [1]

The mechanism retrieves applicable policy and attributes, evaluates a decision and enforces it. NIST distinguishes decision, enforcement, information and administration functions, which can be distributed without eliminating enforcement at resource access.

Rules can apply at request time without rewriting a resource list for every arrival. Appropriate attributes can make an existing rule apply to a new subject, but a self-supplied department string is not automatically a trusted assertion of membership.

References: [1]

Authorized sources establish and maintain attributes, with different authorities responsible for different information. Departure, withdrawn qualifications or resource reclassification can change decisions through updated values, making accuracy and binding part of the mechanism.

Caching reduces remote-read latency but affects freshness and revocation propagation. ABAC neither mandates fetching everything remotely on every request nor justifies indefinite caching. Accepted staleness, disconnection behavior and availability require explicit policy.

References: [1]