Glossary

ABAC

Attribute-based access control

Each request is decided by a policy over attributes of the subject, the resource, the action and the environment, such as department, data classification or time. It expresses fine-grained rules that roles cannot, but depends on trustworthy attribute sources and on policies tested like code.

Defined in: NIST SP 800-162, Guide to Attribute Based Access Control

Covered in

Guide

Authorization models: RBAC, ABAC, ReBAC and policy as code you can test

Translate roles, attributes and relationships into explicit subject-action-resource decisions, prevent broken object level authorization (BOLA), and verify ownership and tenant boundaries with tests.

Practice: Local project: Secure a real HTTP API