What is an Attribute-Based Access Control?

Where role-based access control (RBAC) asks "does this user have the admin role," ABAC asks a richer question: does this user's department, the resource's sensitivity classification, the time of day, and the request's origin IP together satisfy a defined policy. This lets a single policy express far more nuanced rules — "finance staff can approve invoices under $10,000 during business hours from a company network" — than a role name alone ever could. ABAC's flexibility comes with real complexity: policies can become hard to audit and reason about if attributes and rules proliferate without discipline, which is why mature ABAC deployments centralize policy definitions in one evaluated engine rather than scattering ad hoc attribute checks across many services. Multi-tenant SaaS platforms lean on ABAC heavily, since tenant ID itself is usually the single most important attribute gating nearly every access decision. For systems where an AI agent is the one making requests, ABAC becomes especially important because the "user" attribute might be an agent acting on a human's behalf — policy needs to account for what the agent is authorized to do, on whose authority, and under what tool-scope, not just a static account role.