This lesson's interactive features are locked, please to keep using them
RBAC vs. ABAC
Choosing an access control model isn't about one being better than the other. It's about which trusted facts a policy needs.
Role-Based Access Control (RBAC) asks:
What role does this user have?
Attribute-Based Access Control (ABAC) asks:
What is true about this user, this resource, this action, and this request?
RBAC for Stable Responsibilities
RBAC is a natural fit when permissions follow a user's job or responsibility. It's popular in business-to-business (B2B) SaaS applications where users have stable roles like admin, support, or accountant.
ABAC for Resource-Specific Rules
ABAC is a better fit when the decision depends on a more complex relationship, resource state, or request context. For example, an ecommerce shop might allow a promo code to be applied to a cart only if:
- The user is in a specific geographic region, and
- The cart contains at least one item from a specific category, and
- The request is made before the promo code's expiration date.
Mixing Models
Real applications often use both RBAC and ABAC. That's okay!
RBAC and ABAC are not mutually exclusive models, and a role can itself be treated as a user's attribute. Use the simplest model your application needs so its authorization policies stay easy to understand and maintain.
Choose the Best-Fit Model
Use RBAC when a stable role captures the whole rule. Use ABAC when the decision depends on ownership, state, or context. Combine them when both kinds of facts matter.