A security posture in which access is denied unless a policy explicitly permits the request.

Granting only the minimum access needed to perform a legitimate task, for the minimum necessary time.

Role-based access control: permissions are assigned to roles, and users gain permissions through role assignment.

Attribute-based access control: policies evaluate attributes of the subject, resource, action, and environment.

Relationship-based access control: decisions depend on relationships such as owner, member, manager, or assigned reviewer.

Policy Decision Point, the component that evaluates policy and returns an authorization decision.

Policy Enforcement Point, the component that enforces an authorization decision at or near a protected resource.

Attribute-based access control, in which policy evaluates attributes of the subject, resource, action, and environment.

From Roles to Dynamic Authorization — Enterprise IAM and Zero Trust Architecture

Q: An engineering company wants project members to view design files, project owners to edit them, and external contractors to access only assigned projects from managed devices until their contracts end. What is the strongest design?

A hybrid: roles for durable job duties, relationships for project membership and ownership, and attributes for managed-device and contract-end checks. A hybrid design avoids role explosion while expressing the real policy. Roles capture durable duties, relationships connect people to projects, and attributes enforce device posture and time-bound contractor eligibility. A PEP should enforce each decision and trigger reevaluation when relevant context changes.

1. Authentication Is Not Authorization

Identity is only the start

A successful sign-in identifies a person, service, or device. It does not prove that the identity may perform every possible action.

The authorization question

Evaluate subject, action, resource, and context. The same user may be allowed to read one record, but denied permission to approve or delete it.

Secure defaults

Default deny means access requires an explicit allow. Least privilege means that allow should cover only the access needed for a legitimate task.

2. Start with RBAC for Stable Job Duties

How RBAC works

RBAC assigns permissions to roles, then assigns people to roles. This reduces repetitive, error-prone grants to individual accounts.

Finance example

`StudentEmployee` submits expenses; `DepartmentApprover` approves; `Finance_Auditor` views finalized records without editing them.

The role-explosion warning

Use roles for stable duties. If a role name includes a project, date, location, and exception, the model probably needs attributes or relationships instead.

3. Quick Check: Spot the Better Control

A company creates a distinct role for every client, region, project, and temporary assignment. Which improvement is most appropriate?

Create even more detailed roles so every exception has a label
Keep durable job roles, then use attributes or relationships for client, region, project, and temporary conditions
Give all employees a broad role and rely on training not to misuse it
Remove default deny so users can request access only after an error occurs

Show Answer

Answer: B) Keep durable job roles, then use attributes or relationships for client, region, project, and temporary conditions

This is role explosion. Stable job responsibilities remain good RBAC candidates, while changing facts such as project membership, region, ownership, and dates are better represented as attributes or relationships.

4. Add Attributes and Relationships

ABAC: facts drive the decision

ABAC evaluates facts about the subject, resource, action, and environment. Examples include department, classification, device status, and time.

ReBAC: connections drive the decision

ReBAC asks how entities are related: Is this user the document owner, a team member, a patient's clinician, or an assigned reviewer?

Use a hybrid model

A practical pattern is RBAC for baseline duties, plus ABAC and ReBAC to apply project membership, ownership, device posture, location, or time constraints.

5. Turn a Business Rule into a Decision Flow

Start with the requested action

Translate a broad statement into a specific request: `approvepurchaseorder` on a purchase order with known amount, requester, department, and status.

Add decision constraints

Require an approver role, department-management relationship, approval limit, managed device, and acceptable session risk. Block self-approval.

Make ambiguity visible

Terms like "manager" and "appropriate staff" are not policy-ready. Define delegation, effective dates, exceptions, and missing-data behavior explicitly.

6. Write a Testable Authorization Policy

Policy-as-code example

This illustrative policy uses Rego-style syntax. It allows purchase-order approval only when every required condition is true.

```rego

package purchase_orders

default allow:= false

allow if {

input.action == "approve"

input.user.roles[] == "PurchaseApprover"

input.user.managed_device == true

input.session.risk != "high"

input.order.requester_id != input.user.id

input.order.amount <= input.user.approval_limit

input.order.departmentid == input.user.manageddepartment_id

input.order.status == "submitted"

}

```

The first line, `default allow:= false`, implements default deny. Each remaining condition maps to a business requirement.

Test both allowed and denied cases. A good test suite includes self-approval, an expired delegation, an unmanaged device, a high-risk session, an amount above the limit, and a missing attribute.

7. Separate Decision from Enforcement

Two complementary components

The PDP evaluates policy and produces a decision. The PEP receives or requests that decision and actually allows or blocks access at the resource boundary.

A practical request flow

The PEP gathers trusted facts, sends a decision request to the PDP, enforces `permit` or `deny`, and records an auditable event.

Authorization can be continuous

For sensitive work, reevaluate after risk, device posture, network, or session conditions change. A valid sign-in does not guarantee ongoing permission.

8. Design the Hybrid Model

Thought exercise: Clinical research portal

A university runs a portal for clinical research files. Decide which mechanism best fits each rule: RBAC, ABAC, ReBAC, or Hybrid.

A data steward may manage dataset metadata.
A researcher may read a study's restricted files only when assigned to that study.
Access to highly sensitive files requires a managed device and a low or medium session-risk signal.
A principal investigator may delegate read access to a collaborator for 30 days.

Suggested reasoning

Rule 1: RBAC because data steward is a durable job responsibility.
Rule 2: ReBAC because assignment links researcher and study.
Rule 3: ABAC because device posture and risk are evaluated facts.
Rule 4: Hybrid because it combines a relationship, a time-bound attribute, and likely role constraints on who may delegate.

Ask one more question for every rule: Where is the authoritative source for each fact? A policy is only as reliable as its identity, HR, project, device, and risk data.

9. Detect Excess Access and Toxic Combinations

Review effective access

Review the access a person can actually exercise, including permissions inherited through roles, groups, relationships, attributes, and temporary grants.

Find toxic combinations

`VendorCreate` plus `InvoiceApprove` can create a fraud path. This is a segregation-of-duties conflict even if each permission seems reasonable alone.

Prevent and detect

Prevent incompatible assignments when possible. Also detect stale memberships, unused privileges, conflicts, and temporary grants that remain after their end date.

10. Key Terms Review

Flip each card, then explain the term using your own example.

Default deny: A security posture in which access is denied unless a policy explicitly permits the request.
Least privilege: Granting only the minimum access needed to perform a legitimate task, for the minimum necessary time.
RBAC: Role-based access control: permissions are assigned to roles, and users gain permissions through role assignment.
ABAC: Attribute-based access control: policies evaluate attributes of the subject, resource, action, and environment.
ReBAC: Relationship-based access control: decisions depend on relationships such as owner, member, manager, or assigned reviewer.
PDP and PEP: The Policy Decision Point evaluates policy; the Policy Enforcement Point enforces the resulting decision near the protected resource.
Toxic entitlement combination: A combination of permissions that creates unacceptable risk, such as creating vendors and approving their invoices.

11. Final Scenario

Choose the design that best balances manageability, precision, and risk control.

An engineering company wants project members to view design files, project owners to edit them, and external contractors to access only assigned projects from managed devices until their contracts end. What is the strongest design?

One broad Engineer role for employees and contractors
A unique role for every person, project, device, and contract date
A hybrid: roles for durable job duties, relationships for project membership and ownership, and attributes for managed-device and contract-end checks
Allow access after sign-in and use quarterly reviews to remove mistakes