Hybrid RBAC and ABAC

Purpose

High-assurance access models usually need both RBAC and ABAC.

RBAC defines what a person is normally allowed to do based on role. ABAC then applies additional contextual controls based on attributes and risk.

Standard Pattern

Use RBAC for stable permission grouping:

• project roles;

• platform roles;

• engineering roles;

• support roles;

• reviewer roles;

• supplier roles.

Use ABAC for dynamic decisions:

• classification boundary;

• clearance or vetting status;

• customer approval;

• SoW membership;

• device compliance;

• MFA status;

• environment;

• time-bound access;

• emergency access;

• data owner restrictions.

Decision Model

Access is granted only if all tests pass:

1. identity is verified;

2. account is active;

3. screening or vetting status is valid;

4. user has an approved RBAC role;

5. required ABAC attributes are satisfied;

6. separation of duties constraints are not breached;

7. access is within approved time and project scope;

8. the action is logged.

Evidence

• role catalogue;

• attribute catalogue;

• policy decision table;

• access matrix;

• approval records;

• test evidence;

• access review records;

• audit logs.