Gal Helemski
February 28, 2023
Authorization, the process of determining who can access what, has been evolving steadily since the 1980s. Today, flexible, dynamic Policy Based Access Control (PBAC) secures an ever increasing volume of data against ever evolving cyber-threats.
What are the main access control models?
Six access control models cover nearly every authorization decision in enterprise software. Access control lists (ACL) and mandatory access control (MAC) came first, followed by role-based access control (RBAC), attribute-based access control (ABAC), relationship-based access control (ReBAC) and policy-based access control (PBAC), which combines roles, attributes and relationships under one policy layer.
RBAC vs ABAC vs ReBAC vs PBAC compared
| Model | Decision basis | Where policy lives | Granularity | Main limitation |
|---|---|---|---|---|
| RBAC | The role assigned to the user | Role definitions inside each application or directory | Coarse. Permissions are fixed per role | Role explosion, and no reading of context such as time or device |
| ABAC | Attribute values on the user, the resource and the environment | Rules in an external engine, often written in XACML | Fine. Evaluated per request | Attribute sprawl, and rule syntax only developers can read |
| ReBAC | The relationship between a user and a resource | A relationship graph queried at request time | Fine. Evaluated per object | Graph upkeep, and a weak fit for conditions like location or risk score |
| PBAC | Business policy that reads roles, attributes and relationships together | One central policy layer, enforced across the stack | Fine or coarse, set per policy | You need a policy management platform to keep policies governable |
What is role-based access control (RBAC)?
Role-based access control (RBAC) grants access by assigning permissions to roles rather than to individual people. You create a role for each job function, attach permissions to that role, then link users to roles. Anyone holding the role inherits every permission attached to it.
RBAC arrived in 1992 to fix the weaknesses of access control lists, and it gave administrators something ACL never had. Change the permissions on a role and every user in that role picks up the change. Move someone into a new role and their access follows them.
Two problems show up once you run RBAC at enterprise scale.
Coarse-grained and static access decisions
RBAC cannot read context. It authorizes on the role alone and ignores attributes that change, such as time, location or device. Access rights stay fixed, so a temporary assignment to another department has no clean way to be expressed. You either over-grant the role or raise a ticket.
Role explosion
Role counts grow faster than headcount does. As a company expands, teams define thousands of near-identical roles, and nobody can say what granular permissions sit behind any one of them. Tracking roles through promotions and leavers gets harder, unneeded permissions survive, and you carry that gap into your next audit.
What is attribute-based access control (ABAC)?
Attribute-based access control (ABAC) decides each request by evaluating attributes: who the user is, what the resource holds, and the context of the call such as time, device or location. Instead of tying permissions to a fixed role, you write rules that compare attribute values and return allow or deny.
ABAC solves the context problem that RBAC cannot touch. A rule can grant a claims handler access to a policy record during working hours from a managed device, and deny the same person at midnight from an unmanaged laptop. The cost shows up in maintenance, because someone has to own the attribute sources and the rule syntax, and in most organizations that someone is a developer.
What is relationship-based access control (ReBAC)?
Relationship-based access control (ReBAC) grants access based on how a user connects to a resource rather than what role they hold. If you own a folder, you can read every document inside it, and anyone you share that folder with inherits the same access through that relationship.
Google Docs works this way, and so does every B2B portal where a partner admin manages users under their own account and nobody else's. Read more in our guide to relationship-based access control.
Policy Based Access Control (PBAC):
PBAC has the flexibility to be Fine-Grained or Coarse-Grained: PBAC supports environmental and contextual controls, so policies can be set to grant access to resources at certain times and from certain locations and even evaluate relationships between identities and resources. Groups of users can be added, removed, or amended with ease and obsolete permissions revoked with a click.
PBAC makes it easy to create and test policies: PlainID Policy Manager has easy to use GUI, for quick writing, reviewing, testing and implementing of even the most complex access policies. Unlike PBAC, for example, XACML, a standardized Attribute Based Access Control language, requires specific coding skills and can’t be used or understood by people who aren’t experienced developers.
PBAC gives transparency and visibility: Visualizing and mapping the relationship between the identities and the resources is the first step in setting a strong access management policy. PBAC gives administrators a clear view of who is authorized to do what, across all organizational assets. It also provides full and transparent visibility for compliance with GDPR and other relevant regulations. As a result of its many strengths, PBAC closes security gaps left by RBAC, enhances your cybersecurity and delivers a proactive response to Data and Privacy regulation compliance.
In summary:
“Companies that haven’t solved for access control are not only putting themselves at risk -- they are also suboptimizing every dollar of their cybersecurity spend.” - Richard Bird, Forbes Technology Council
RBAC has dominated access control since the 1990’s, but it doesn’t suit the needs of today’s fast paced, diverse, cloud-based environments.
By contrast, PlainID’s Authorization Platform offers contextual, fine-grained access control, and full visibility, together with an easy to use UI for authoring and managing complex access policies, without code. PBAC offers a proactive approach to compliance and gives the best access control for cybersecurity needs. All this, without interrupting the workflow of legitimate users.
Want to know more? Download the Whitepaper: PBAC vs RBAC: The Truth
