Explain like I'm five · Security

What is ABAC?

Attribute-Based Access Control, told as a story about tags and if-sentences.

a 'cook·night' hat, a 'cook·no guests' hat…Cook+02:00=?'cook, but only at night' — no hat says that

A hat can't say 'only at night'.The last scene of the hat story. A hat for every condition means a hundred hats.

cookworks on 3F2 years herekitchensharp toolsnow 02:00no gueststhe hat is only one of the tags

People, rooms and the moment all carry tags.The hat is just one of them.

is a cook ✓it's daytime ✓no guests inside ✓→ OPENcook14:00guests: 0the gatekeeper checks the tags against the sentence

ABAC turns tags into a sentence.'If cook, and daytime, and no guests: open.' The gatekeeper checks the tags against it.

Person tagsrole, team, tenure
Room tagswhich room, how secret
Moment tagstime, place, device
The sentencethe rule that ties them together
14:0002:00the same cooksame hat, different hour

Same person: open by day, shut at night.No new hat needed. One sentence does it.

is a cookdaytime, or on dutyno guests, or at most threeworks on 3F, andtook last week's trainingexcept on rainy days…why won't it open?…hard to answer

A long sentence, and nobody can read it.'Why won't it open?' gets hard to answer. So most castles sort by hat (RBAC) first and add only a few conditions on top.

In one breath

ABAC = instead of a hat, a sentence built from tags on the person, the room and the moment opens the door.

Attribute-Based Access Control, written up by NIST as SP 800-162 (2014). Cloud permissions (AWS IAM conditions) work this way; in practice it's layered on top of RBAC.

When grown-ups say it

Attribute
A tag. One fact about a person, room or moment: 'cook', '3F', '02:00'.
Subject
The person's tags. Who wants in: role, team, tenure, training.
Resource
The room's tags. What they want into: which room, how secret.
Environment
The moment's tags. Time, place, which device, whether guests are in.
Policy
The sentence. "If cook and daytime and no guests: open." → the hat story
Policy Decision Point (PDP)
The gatekeeper who reads the sentence. Matches tags to the sentence and says open or closed.
Policy Enforcement Point (PEP)
The hand on the door. Actually does what the gatekeeper decided.
Policy language
How sentences are written. XACML, Cedar, AWS IAM condition blocks.
Next story
The Master Key in the Vault →
Want another term as a picture book? Request →