access-controllisted

# Access Control ## RBAC vs ABAC | | RBAC (Role-Based) | ABAC (Attribute-Based) | |-|-------------------|------------------------| | Access based on | User roles | Attributes (user, resource, environment) | | Flexibility | Lower — roles must be predefined | Higher — dynamic, context-aware | | Complexity | Lower to implement | Higher to implement and audit | | Best for | Stable org structures, clear job functions | Dynamic environments, fine-grained control | | Example | "Manager" role can approve expenses | User with dept=Finance AND clearance=High AND time=business-hours can view salary data | | Standards | NIST RBAC model | XACML, ABAC NIST SP 800-162 | ### When to Use Each - **RBAC**: Most enterprise systems — clear roles, predictable access patterns - **ABAC**: Regulatory environments requiring context-sensitive access, multi-tenant SaaS, zero-trust architectures - **Hybrid**: Use RBAC for coarse-grained access + ABAC for fine-grained attribute checks within a role ## Least Privilege Implementation ### Principles 1. Grant minimum permissions needed to perform the job function 2. Default deny — explicitly grant, never implicitly allow 3. Time-bound access — grant for duration needed, auto-expire 4. Just-in-time (JIT) access — provision on request, deprovision after use 5. Separation of duties — no single person controls a critical process end-to-end ### Least Privilege Audit Checklist - [ ] All service accounts have documented purpose and minimum required permissions