Attribute-based access control
Attribute-based access control is an authorization model that evaluates subject, resource, action, and contextual attributes against policies to make access decisions.
Authorization in Action
Attribute-based access control (ABAC) is an authorization approach that makes decisions by evaluating attributes of subjects, resources, actions, and contextual conditions against rules.
- How it is used
- Applies context-sensitive authorization to internal systems where time, device posture, clearance, region, or purpose affect access.
- How deep it goes
- Explains attribute categories, runtime policy evaluation, reference architecture, strengths, limitations, and model selection without formal policy semantics.
- Examples
- Uses financial-document, production-deployment, HR-record, and regulated-report access scenarios driven by clearance, device, time, region, and purpose.
- What you can do after
- Evaluate/understand when contextual attributes and layered policies suit an authorization problem, including their governance and relationship-model tradeoffs.
Read how Authorization in Action explains attribute-based access control →
Software Security for Developers
An attribute-based access rule is a condition that grants or denies access by comparing relevant subject, resource, or environmental attributes.
- How it is used
- Uses user, resource, and environmental attributes to make fine-grained authorization decisions when predefined roles are insufficient.
- How deep it goes
- Defines attributes, gives matching-rule examples, and discusses monolith and service deployment, but defers policy-engine implementation details.
- Examples
- Uses department-matched documents, regional invoices, clearance levels, working hours, IP addresses, and inconsistent regional values.
- What you can do after
- Evaluate/understand it by choosing ABAC for dynamic, attribute-dependent access and identifying consistency risks across services.
Read how Software Security for Developers explains attribute-based access control →
Secure APIs
Attribute-based access control is an authorization model that determines permissions from attributes of users, resources, and contextual conditions.
- How it is used
- Determines API access by evaluating user attributes against requested data or operations.
- How deep it goes
- Explains token-derived identity, database lookups, hierarchical scopes, and business rules, while warning that complexity makes validation difficult.
- Examples
- Uses project-management scopes, geographical attributes, read/write functions, and bank-account verification tests.
- What you can do after
- Diagnose authorization failures by testing whether required user attributes and state conditions are enforced.
Read how Secure APIs explains attribute-based access control →
Architecting an Apache Iceberg Lakehouse
Attribute-based access control is an authorization technique that makes permission decisions from attributes of users, resources, actions, or context.
- How it is used
- Governs catalog permissions by evaluating user attributes when controlling access to tables and namespaces.
- How deep it goes
- Defines attribute-based decisions and architectural placement, but stops short of specifying policy syntax or enforcement implementation.
- Examples
- Uses department and location attributes to illustrate authorization decisions for catalog-managed tables and namespaces.
- What you can do after
- Evaluate catalog requirements and determine how attribute-based policies should integrate with identity systems and query-engine enforcement.
Read how Architecting an Apache Iceberg Lakehouse explains attribute-based access control →
Related concepts
- role-based access controlcontrasts with · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
- attributeuses · An attribute is a named property, value, or piece of information associated with an entity, object, or program element.
- policyuses · A policy is a rule, strategy, or mapping that governs or determines decisions, actions, permissions, or behavior under specified conditions.
- relationship-based access controlcontrasts with · Relationship-based access control is an authorization technique that makes decisions from defined relationships among principals, resources, groups, and other entities.
- authorization modelkind of · An authorization model is a formal scheme that represents authority and determines whether subjects may perform actions on resources.
- authorizationkind of · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.