What is the difference between RBAC and ABAC?

Question

Accepted Answer

**RBAC** — role-based access control. **ABAC** — attribute-based access control.

**RBAC:**
- Access based on role.
- Simple, predefined roles.
- Easy to manage.
- Limited flexibility.

```
RBAC:
Admin → Full access
Editor → Edit access
Viewer → Read only
(Role determines access)
```

**ABAC:**
- Access based on attributes.
- Flexible, fine-grained.
- Complex to manage.
- Context-aware.

```
ABAC:
IF user.department == "Finance"
AND resource.classification == "Confidential"
AND time.hour BETWEEN 9 AND 17
THEN allow access
(Attributes determine access)
```

**Key differences:**
- **RBAC** — role-based.
- **ABAC** — attribute-based.
- **RBAC** — simple.
- **ABAC** — flexible.

Systems Analyst: What is the difference between RBAC and ABAC?