---
title: "Attribute-Based Access Control — Identity Glossary | IDSync"
description: "Attribute-Based Access Control (ABAC) decides whether a user can take an action by evaluating attributes of the user, the resource, the action, and the…"
lang: en
json-ld: |
  [
    {
      "@context": "https://schema.org",
      "@type": "BreadcrumbList",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://idsync.com/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Glossary",
          "item": "https://idsync.com/glossary"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "Attribute-Based Access Control",
          "item": "https://idsync.com/glossary/attribute-based-access-control"
        }
      ]
    },
    {
      "@context": "https://schema.org",
      "@type": "DefinedTerm",
      "@id": "https://idsync.com/glossary/attribute-based-access-control",
      "name": "Attribute-Based Access Control",
      "alternateName": [
        "ABAC",
        "ABAC",
        "Policy-Based Access Control",
        "PBAC"
      ],
      "description": "Attribute-Based Access Control (ABAC) decides whether a user can take an action by evaluating attributes of the user, the resource, the action, and the environment against a policy — instead of relying solely on group or role membership.",
      "url": "https://idsync.com/glossary/attribute-based-access-control",
      "inDefinedTermSet": "https://idsync.com/glossary"
    }
  ]
---

[![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/)

[Directory](/directory)

[Compare](/compare)

[Resources](/resources)

[Browse tools](/directory)[Run Stack Finder](/stack-finder)

1.  [Home](/)
2.  [Glossary](/glossary)
3.  Attribute-Based Access Control 

Authorization

# Attribute-Based Access Control (ABAC)

Attribute-Based Access Control (ABAC) decides whether a user can take an action by evaluating attributes of the user, the resource, the action, and the environment against a policy — instead of relying solely on group or role membership.

Last reviewed 3 months ago

Key points

-   ABAC evaluates attributes at request time (user.department, resource.classification, time, IP, device posture).
-   Policies are typically expressed as rules or in a policy language (Rego/OPA, Cedar, XACML).
-   ABAC scales better than RBAC for fine-grained, context-aware access — but is harder to audit if policies aren't centralized.
-   Modern implementations: AWS IAM conditions, Google Cloud IAM conditions, Open Policy Agent (OPA), Amazon Verified Permissions (Cedar), Permit.io, Oso, Styra.
-   Most real systems are hybrid: RBAC for coarse-grained roles, ABAC for conditions that refine those roles.

## What is ABAC?

Attribute-Based Access Control (ABAC) makes access decisions by evaluating **attributes** — properties of the user (department, clearance, manager), the resource (owner, classification, project), the action (read, write, delete), and the environment (time of day, network, device posture) — against a **policy**.

Where [RBAC](/glossary/rbac) says _"members of the 'Finance' role can read invoices,"_ ABAC says _"users whose 'department' = 'Finance' AND 'clearance' >= 'Confidential' can read invoices owned by their cost center, from a managed device, during business hours."_

## How it works

A standard ABAC request flows through four logical components (originally from XACML, but the pattern is universal):

1.  **PEP (Policy Enforcement Point)** — the app/proxy/sidecar that intercepts the request.
2.  **PDP (Policy Decision Point)** — evaluates the policy against the input.
3.  **PIP (Policy Information Point)** — fetches missing attributes (HR data, device posture, resource metadata).
4.  **PAP (Policy Administration Point)** — where humans author and version policies.

Modern stacks usually collapse this into a policy engine like **Open Policy Agent** (Rego), **Cedar** (AWS / Permit.io), or **Oso Cloud**, with attributes pushed in as JSON.

## When buyers care

-   **Fine-grained, multi-tenant SaaS** — "user X can edit document Y if they're in workspace W and the doc isn't locked."
-   **Data access governance** — column- and row-level policies in Snowflake, Databricks, BigQuery.
-   **Cloud infrastructure** — AWS IAM conditions, Google Cloud IAM conditions, and CIEM tools all rely on attributes.
-   **Compliance** — separation of duties, least privilege, and "need to know" map naturally to attribute rules.

## Common misconceptions

-   **"ABAC replaces RBAC."** Almost never. Real systems use RBAC for the coarse layer and ABAC for the conditional refinements.
-   **"ABAC is just IF statements in code."** Hardcoding attribute checks in app code is the anti-pattern ABAC is meant to fix — externalize policy into a dedicated engine so security can audit and update it without redeploying.
-   **"Attributes always come from the IdP."** They come from anywhere: HRIS, CMDB, device management, the resource itself.

## ABAC vs RBAC vs ReBAC

| Model | Decision unit | Best for | | --- | --- | --- | | RBAC | Role → permission | Workforce apps, predictable job functions | | ABAC | Attributes + policy | Context-aware access, regulated data, cloud IAM | | ReBAC | Relationships in a graph | Multi-tenant SaaS, document/file sharing (Google Docs model) |

## Editorial note

If a vendor pitches ABAC, ask where policies live, how attributes are fetched at decision time, and what the latency budget is. A great policy engine that takes 300ms to answer is unusable on a hot API path.

## Standards & references

-   [NIST SP 800-162 — Guide to ABAC](https://csrc.nist.gov/publications/detail/sp/800-162/final)

IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about).

### One identity concept, explained per issue

Get vendor-neutral identity explainers and market updates in your inbox.

Work email\* 

Name

Company

Role (optional)

Interests (optional)

Pick what you want more of.

IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents

Subscribe

Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time.

### Vendor categories

[authorization](/directory/category/authorization)[iam platforms](/directory/category/iam-platforms)

### Related terms

[rbac](/glossary/rbac)[policy as code](/glossary/policy-as-code)[zero trust](/glossary/zero-trust)[rebac](/glossary/rebac)

### Not sure which tool you need?

Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack.

[Run the Stack Finder](/stack-finder)

### Explore tools for this topic

Browse vetted vendors in the authorization category.

[Explore tools](/directory/category/authorization)

[![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/)

The buyer-focused platform for identity, access, and authentication software.

#### Platform

-   [Home](/)
-   [IAM Stack Finder](/stack-finder)
-   [Directory](/directory)
-   [Resources](/resources)
-   [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026)
-   [Buyer Guides](/guides)
-   [Glossary](/glossary)
-   [Newsletter](/newsletter)
-   [Newsletter Archive](/newsletter/archive)

#### Best of guides

-   [All comparisons](/compare)
-   [All vendor alternatives](/alternatives)
-   [Best SSO tools](/compare/best-sso-tools)
-   [Best MFA tools](/compare/best-mfa-tools)
-   [Best PAM tools](/compare/best-pam-tools)
-   [Best IGA tools](/compare/best-iga-tools)
-   [Best CIAM tools](/compare/best-ciam-tools)
-   [Best passwordless auth](/compare/best-passwordless-authentication-tools)
-   [Best identity security](/compare/best-identity-security-tools)
-   [Best machine identity](/compare/best-machine-identity-tools)
-   [Best SaaS access governance](/compare/best-saas-access-governance-tools)
-   [Best developer auth](/compare/best-developer-authentication-tools)
-   [Best for startups](/compare/best-iam-tools-for-startups)
-   [Best for enterprises](/compare/best-iam-tools-for-enterprises)
-   [Best SCIM tools](/compare/best-scim-provisioning-tools)
-   [Best for AI agents](/compare/best-ai-agent-identity-tools)
-   [Best NHI tools](/compare/best-nhi-management-tools)
-   [Okta pricing explained](/guides/okta-pricing)
-   [Auth0 pricing explained](/guides/auth0-pricing)
-   [Okta alternatives](/alternatives/okta)
-   [Auth0 alternatives](/alternatives/auth0)

#### For Vendors

-   [Sponsor](/sponsor)
-   [Badges](/badges)
-   [Submit Product](/submit-product)
-   [Claim Profile](/claim-profile)
-   [Partner](/partner)

#### Company

-   [About & Methodology](/about)
-   [Contact](/contact)
-   [Privacy](/privacy)

Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only.

IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation).

© 2026 IDSync. All rights reserved.

Editorial independence. Sponsored placements are clearly disclosed.