1 min lesson
Authorization models & least privilege
Use two rows in "Authorization models & least privilege" to state the practical decision rules.
Step 1 of 2
The goal isn't to lock everything down - it's to make the right access automatic and the wrong access impossible to keep. Standing privilege is debt; you design so it pays itself off.
Three models do the heavy lifting and a real environment combines them. The interview test is whether you can say when each fits rather than reciting definitions.
- Model
- RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition.
- Access keyed on
- Role → a fixed set of permissions
- Fits when
- Stable, well-defined job functions; the default for most apps
- Model
- ABAC
- Access keyed on
- Attributes (dept, location, clearance, device)
- Fits when
- Context-sensitive rules RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. can't express cleanly
- Model
- Dynamic groups
- Access keyed on
- Live attribute query → auto membership
- Fits when
- Membership should track HR data with zero manual upkeep
| Model | Access keyed on | Fits when |
|---|---|---|
| RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. | Role → a fixed set of permissions | Stable, well-defined job functions; the default for most apps |
| ABAC | Attributes (dept, location, clearance, device) | Context-sensitive rules RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. can't express cleanly |
| Dynamic groups | Live attribute query → auto membership | Membership should track HR data with zero manual upkeep |
RBAC for the backbone, ABAC for the nuance, dynamic groups to keep both self-maintaining.
These combine: a dynamic group built from an ABAC-style query ("department = Engineering AND employment = full-time") becomes the RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. unit that grants a bundle of apps. Attributes feed groups, groups grant roles.