An attribute is information about a user, resource, or environment that an access-control rule can evaluate. Examples include department, clearance, document owner, sensitivity, request time, IP address, and device type. section 17.1.2
Attribute-based access control (ABAC) grants access when attributes satisfy conditions, such as matching a user’s department to a document’s department or meeting a clearance requirement. This supports fine-grained, context-aware decisions instead of broad, predefined roles. section 17.1.2 section 17.3
Common attribute-driven decisions include:
- Allow finance users to access invoices marked region=EU. section 17.1.2
- Allow operators with high clearance to download encrypted backups. section 17.1.2
- Deny requests made outside working hours. section 17.1.2
Multiple attributes in one decision
A document rule grants access when the user has top clearance or belongs to the US region. Mary passes through clearance, John through region, and Bob is denied because neither condition matches. section 17.1.2
Attributes can enforce least privilege by granting access only when the relevant conditions match. Their flexibility also increases policy complexity; overly specific role-based alternatives can create role explosion and become difficult to manage or audit. section 17.1.2 section 17.3
