Attribute-Based Access Control (ABAC)

Purpose

Implement fine-grained access control using policies that evaluate attributes of the subject, resource, action, and environment. ABAC enables dynamic, context-aware authorization decisions without requiring per-role or per-user permission assignments.

Agent Protocol

Trigger

Exact user phrases: "ABAC", "attribute-based access control", "fine-grained permissions", "policy-based access", "OPA authorization", "Rego", "XACML", "attribute policies", "context-aware auth", "dynamic permissions", "risk-based access", "environment-aware auth", "conditional access", "policy combining", "attribute sources".

Input Context

• Authorization requirements that RBAC cannot satisfy (document-level, context-dependent, multi-attribute).
• Available attribute sources (user profile, resource metadata, device info, geolocation, time).
• Existing auth infrastructure (JWT claims, user directory, resource database).
• Policy engine preference (OPA, Casbin, Cerbos, custom).
• Compliance rules that involve conditional access.

Output Artifact

ABAC architecture: attribute catalog, policy structure, evaluation flow, engine integration plan, test strategy.