> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/security-vetting-and-technical-assurance-playbook/identity-access-and-zero-trust/hybrid-rbac-and-abac.md).

# Hybrid RBAC and ABAC

### Purpose

High-assurance access models usually need both RBAC and ABAC.

RBAC defines what a person is normally allowed to do based on role. ABAC then applies additional contextual controls based on attributes and risk.

### Standard Pattern

Use RBAC for stable permission grouping:

* project roles;
* platform roles;
* engineering roles;
* support roles;
* reviewer roles;
* supplier roles.

Use ABAC for dynamic decisions:

* classification boundary;
* clearance or vetting status;
* customer approval;
* SoW membership;
* device compliance;
* MFA status;
* environment;
* time-bound access;
* emergency access;
* data owner restrictions.

### Decision Model

Access is granted only if all tests pass:

1. identity is verified;
2. account is active;
3. screening or vetting status is valid;
4. user has an approved RBAC role;
5. required ABAC attributes are satisfied;
6. separation of duties constraints are not breached;
7. access is within approved time and project scope;
8. the action is logged.

### Evidence

* role catalogue;
* attribute catalogue;
* policy decision table;
* access matrix;
* approval records;
* test evidence;
* access review records;
* audit logs.