6 Dynamic authorization models

Authorization at ACME Corp evolved from a simple, role-based setup into a more adaptable system as the company expanded. RBAC initially brought order, faster onboarding, and easier audits, but it began to break down as people took on multiple responsibilities and the business grew more collaborative and distributed. Alice needed access based on assigned work, Bob needed access scoped to his region, and Carol saw that the organization was drifting back into a patchwork of exceptions. The chapter uses these pressures to show why static authorization alone is not enough for modern systems.

To address collaboration and scope, the chapter introduces relationship-based access control and attribute-based access control. ReBAC grants access through paths in a relationship graph, making it ideal for shared documents, support tickets, and delegated ownership; ACME uses it so access follows real business relationships such as owner, editor, manager, and viewer. ABAC, by contrast, makes decisions from attributes of the person, resource, and environment, enabling precise rules based on clearance, department, device status, time, region, and other conditions. ReBAC is strongest when access follows durable relationships, while ABAC excels when access depends on changing context.

The chapter concludes by framing policy-based access control as the unifying approach. PBAC externalizes authorization logic and evaluates policies at runtime, treating roles, attributes, and relationships as inputs rather than separate models. This lets ACME combine RBAC for broad job structure, ReBAC for collaboration, and ABAC for contextual control in one coherent architecture. The main message is that dynamic authorization works best as a layered strategy: choose the model, or mix of models, that best matches how access actually needs to be decided.

A relationship graph used by ACME Corp’s Customer Collaboration platform. Employees like Bob and Alice are linked to customer accounts through roles such as support engineer and solution architect. Access to resources such as support tickets and deployment plans is controlled by these relationships, allowing for dynamic, fine-grained authorization decisions based on who is connected to what and how.

 Relationship-based authorization using graph traversal and policy evaluation. Access is determined by analyzing relationships between principals and resources.

 The user interface for the application lets users affect access to documents by letting them change the relationship graph. In this figure, Bob is sharing “support ticket #456” with Kate, making her a Viewer.

Attribute-based authorization with principal, resource, and environment attributes. Access decisions are based on evaluating policies in the context of attributes from multiple sources. Alice’s attributes meet the policy conditions, so access is granted. Bob’s do not, so access is denied.

• ACLs, RBAC, ReBAC, and ABAC each offer distinct approaches to authorization. They differ in how access decisions are described and enforced, ranging from simple lists to dynamic, context-aware policies.
• ReBAC bases access on relationships between entities, such as ownership or team membership. This model works especially well in collaborative systems where access depends on organizational or social structures.
• ABAC assesses policies based on attributes of the principal, resource, action, and environment. It enables fine-grained, real-time decisions using contextual information such as time, device, or location.
• ReBAC treats policies as relationship data, with access determined by traversing a graph. Policy rules remain the same, while changes to relationships dynamically drive access decisions.
• ABAC treats policies as code evaluated at runtime using current attribute values. This method offers flexible and auditable control but requires careful governance to avoid complexity.
• PBAC combines RBAC, ReBAC, and ABAC by externalizing and dynamically evaluating policy logic. Roles, attributes, and relationships serve as policy inputs, ensuring consistent access control across different systems.
• Different models solve different problems, and combining them results in better outcomes. A hybrid approach often provides the best balance of expressiveness, scalability, and maintainability.

FAQ