SECAI Core · phase 10 of 15
Attribute-based access control
An access control technique that evaluates a set of attributes that each subject possesses to determine if access should be granted.
The Explain card
- Plain English
- Attribute-based access control (ABAC) grants or denies access by evaluating a set of attributes about the subject, the resource and the context, rather than a fixed role.
- Example
- A policy says a user may query the customer-data retrieval index only if their department is Support, their clearance is Confidential or higher, the request comes from the corporate network, and the data's region matches the user's region. Change any attribute and the answer changes.
- Why it matters
- AI systems touch data with many sensitivity dimensions. ABAC expresses fine-grained rules such as "only during business hours" or "only for EU data" that roles alone cannot capture.
- Hook
- Not who you are, but everything about you, right now.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
