1 min lesson
Authorization models & least privilege
Use two rows in "Authorization models & least privilege" to state the practical decision rules.
Step 1 of 2
The goal isn't to lock everything down. It's to make the right access automatic and the wrong access impossible to keep. Standing privilege is debt; you design so it pays itself off.
Three building blocks do the heavy lifting and a real environment combines them. The interview test is whether you can say when each one fits.
- Building block
- RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition.
- Access keyed on
- Role → a fixed set of permissions
- Fits when
- Stable, well-defined job functions; the default for most apps
- Building block
- ABAC
- Access keyed on
- Attributes: dept, location, clearance, device
- Fits when
- Context-sensitive rules RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. can't express cleanly
- Building block
- Dynamic groups
- Access keyed on
- Live attribute query → auto membership
- Fits when
- Membership should track HR data with zero manual upkeep
| Building block | Access keyed on | Fits when |
|---|---|---|
| RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. | Role → a fixed set of permissions | Stable, well-defined job functions; the default for most apps |
| ABAC | Attributes: dept, location, clearance, device | Context-sensitive rules RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. can't express cleanly |
| Dynamic groups | Live attribute query → auto membership | Membership should track HR data with zero manual upkeep |
RBAC for the backbone, ABAC for the nuance, dynamic groups to keep both self-maintaining.
These combine. A dynamic group built from an ABAC-style query such as "department = Engineering AND employment = full-time" becomes the RBACRole-Based Access Control. Granting permissions by role rather than configuring each person individually. Press Enter for the full definition. unit that grants a bundle of apps. Attributes feed groups, groups grant roles.