Policy-Based Access Control (PBAC)

Overview

Policy-based access control makes authorization decisions by evaluating centrally defined policies against attributes and context such as user role, resource, action, device, risk, location, and transaction value.

Policy-Based Access Control (PBAC) is closely connected to Mandatory Access Control (MAC), Security Assertion Markup Language (SAML), and Security Architecture Review. It is broader and more dynamic than a single role check, while mandatory access control is a specific model based on centrally enforced classifications and labels.

Operational implementation should define policy language and ownership, use reliable attributes, apply deny-by-default for sensitive actions, separate policy decision and enforcement points, version rules, test conflicts, log decisions, and govern emergency overrides.

The principal failure modes include stale attributes, conflicting rules, hidden default allows, policy drift, inconsistent enforcement, unavailable decision services, excessive complexity, and poorly controlled exceptions.

Useful measures include policy coverage, denied and allowed decision anomalies, evaluation latency, exception age, rule conflicts, and unauthorized-access findings.

Operationally, teams should define policy language and ownership, use reliable attributes, apply deny-by-default for sensitive actions, and separate policy decision and enforcement points. Key risks include stale attributes, conflicting rules, hidden default allows, and policy drift.

For Policy-Based Access Control (PBAC), the trust decision should establish Policy-based access control makes authorization decisions by evaluating centrally defined policies against attributes and context such as user role, resource, action, device, risk, location, and transaction value and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for resource, action, and device, rather than checking only a successful request. Logs concerning the Policy-Based Access Control context and resource, action, and device should support investigation without exposing reusable secrets or unnecessary personal data.