Updated July 19, 2023

Policy-Based Access Control is a method of controlling user access to one or more systems, where access privileges are determined by combining the business responsibilities of the user with policies. Instead of auditing and modifying roles across the entire organization, PBAC lets you quickly adjust entitlements in response to changes in requirements, ensuring that assets are secured through set rules or policies. PBAC is an adaptable authorization solution because it can support a variety of access points by automating security controls in applications and on data. Like Attribute-Based Access Control (ABAC), the approach combines roles and attributes to produce flexible, dynamic control parameters.

According to NIST SP 800-162, ABAC is a logical access control methodology where authorization to perform a set of operations is determined by evaluating attributes associated with the subject, object, requested operations, and, in some cases, environment conditions against policy, rules, or relationships that describe the allowable operations for a given set of attributes.

ABAC provides access to users based on who they are rather than what they do: for example, the business unit they work in and how they were hired. Attributes allow for an easier control structure because permissions can be based on the user’s type, location, department and so on, mirroring the physical aspects of the business. By looking at a user’s attributes—information that is already known and often stored in an HR system—ABAC permits you to express a rich, complex access control policy more simply. For example, if a user named Margret Smyth is promoted from the Marketing to management, her access permissions will be updated because her business attributes changed, not because someone remembered that she had admin permissions and took the time to update a configuration file somewhere.

PBAC and ABAC are related in that they are both policy-based access control models. However, they differ in the way they define policies and how they use attributes to make access control decisions.

PBAC defines policies based on user roles, job functions, and organizational requirements. These policies are typically static and are defined by administrators. PBAC does not use attributes to make access control decisions.

In contrast, ABAC defines policies based on attributes such as user identity, user attributes (e.g., department, job title), resource attributes (e.g., sensitivity level, location), and context attributes (e.g., time, device). ABAC uses attributes to make access control decisions, and policies can be dynamic and defined by both administrators and users.

ABAC is more flexible than PBAC because it can handle more complex scenarios where policies need to be adapted to changing conditions. ABAC also enables more fine-grained access control because it can define policies based on a wider range of attributes.

ABAC allows an enterprise to extend existing roles using attributes and policies. By adding context, authorization decisions can be made based not only on a user’s role, but also by taking into account who or what that user is related to, what that user needs access to, where that user needs access from, when that user needs access, and how that user is accessing the requested information. ABAC does this by using policies built upon the individual attributes using natural language. For example, a policy may be written as follows: “Doctors can view medical records of any patient in their department and update any patient record that is directly assigned to them, during working hours, and from an approved device.” By creating a policy that is easy to understand, with context around a user and what s/he should have access to, access control becomes far more robust. This functionality expands the scope of RBAC significantly. We no longer need hundreds of overloaded roles, and administrators can add, remove, or reorganize departments and other attributes without having to rewrite the policy. At the end of the day, fewer roles mean simpler role management and easier identity management. Moreover, ABAC enables the execution of business initiatives not previously possible via RBAC alone.

• Flexibility: Both PBAC and ABAC are flexible approaches to access control that can be adapted to different environments and situations. Administrators can define policies that are specific to their organization’s needs, which makes it suitable for use in complex and dynamic environments.
• Compliance: ABAC and PBAC can help organizations comply with regulatory requirements and industry standards by providing a framework for managing access to sensitive data and systems. It enables administrators to define policies that ensure compliance with data protection regulations such as GDPR and HIPAA.
• Scalability: Both frameworks can be used to manage access to resources across different systems and applications. This makes it suitable for use in large and complex organizations where multiple systems need to be secured.

Whether ABAC (Attribute-Based Access Control) is better than PBAC (Policy-Based Access Control) depends on the specific use case and requirements of an organization. Both models have their advantages and disadvantages, and the best approach will depend on factors such as the size and complexity of the organization, the nature of the data and resources being protected, and the regulatory requirements that must be complied with. 

ABAC and PBAC are both policy-based access control models, but they differ in the way they define policies and how they use attributes to make access control decisions. PBAC defines policies based on user roles, job functions, and organizational requirements, while ABAC defines policies based on a wide range of attributes, such as user identity, user attributes, resource attributes, and context attributes. 

The advantage of PBAC is that it is simpler and more straightforward to implement than ABAC, and it can be a good fit for smaller organizations with relatively straightforward access control requirements. PBAC policies are typically static and defined by administrators, which makes them easier to manage. 

The advantage of ABAC is that it provides a more flexible and fine-grained approach to access control, which is essential for larger and more complex organizations. ABAC enables administrators to define policies that are tailored to specific situations and requirements, which makes it easier to manage access to resources in dynamic environments. ABAC also provides more detailed and accurate access control decisions, which reduces the risk of unauthorized access to sensitive data and systems. 

Both PBAC and ABAC have their advantages and disadvantages, and the best approach will depend on the specific requirements and circumstances of the organization. Smaller and less complex organizations may find that PBAC is a good fit, while larger and more complex organizations will benefit from the greater flexibility and granularity of ABAC. For larger organizations, the implementation of ABAC will also aid with reducing the risk of data breaches, as only authorized users have access to sensitive data and systems. Additionally, they will also have improved user experience as users are quickly and easily granted access to resources they need. It can also reduce the burden on IT departments by automating access control decisions based on policies.

To learn more about PBAC and ABAC, check out our articles:

• What is PBAC?
• The Definitive Guide to ABAC