Tutorial 3: RBAC, ABAC, and Least Privilege

Unit 3 · Identity and access management

Objectives

Compare role-based and attribute-based policy.
Limit privilege and avoid role explosion.
Test policy conflicts and deny conditions.

RBAC grants permissions through roles such as analyst or administrator. ABAC evaluates attributes such as department, data classification, device trust, time, and tenant. RBAC is understandable for stable responsibilities; ABAC handles context but requires trustworthy attributes and careful policy evaluation.

allow if subject.department == resource.department
  and resource.classification <= subject.clearance
  and device.managed == true

Least privilege is a lifecycle practice: start narrow, grant temporarily where possible, review usage, and remove stale permissions. Policy engines need explicit precedence, default deny, explainable decisions, and tests for privilege escalation.

Exercises

Model the same policy in RBAC and ABAC.
Find a role-explosion problem.
Write conflict tests where one rule allows and another denies.

Self-check

What is a role?
What is an attribute?
Why does default deny matter?

Self-Check Quiz

1. Which model can naturally use device and time context?

Answer

ABAC can evaluate those attributes, provided they are trustworthy and available to the policy engine.

2. What should happen when policy evaluation fails?

Answer

For sensitive actions, fail closed and produce an operationally useful audit or error signal.

Homework

Design an ABAC policy for confidential research data.
Define attribute sources and their trust.
Write tests for escalation and stale attributes.

Sample answer

The policy checks subject clearance, project membership, resource classification, managed-device state, and purpose. Attribute sources require freshness and integrity controls. Tests cover missing, stale, forged, conflicting, and overbroad attributes; default behavior denies.