Topic
Access Control
How authorization models decide who may act on a resource, and where token-based and role-based approaches break down.
6 posts
Access control decides whether a specific subject may perform a specific action on a specific resource, then enforces that decision. Modern designs split the two jobs: a policy decision point (PDP) evaluates the request against policy, and a policy enforcement point (PEP) applies the verdict. Attribute-based access control (ABAC) supplies the evaluation model, matching subject, resource, action, and environment attributes instead of static group membership.
Role-based models break when exceptions outnumber roles. Teams answer by minting more roles, which produces role explosion and a permission set nobody can audit or safely prune. The second failure is treating authentication as authorization: a valid token proves who is calling, not what that caller may do with a particular object under current conditions.
Posts under this hub compare ABAC, RBAC, and relationship-based models and the questions each one answers. Others examine federation and OAuth failures where forged or stolen tokens satisfied identity checks, and authorization for AI agents, which build delegated credential chains faster than review processes can follow.
Frequently asked questions
What is the difference between ABAC and RBAC?
Role-based access control grants permissions to named roles and assigns users to them, so the decision depends on membership recorded in advance. Attribute-based access control evaluates a policy at request time using attributes of the subject, the resource, the action, and the environment. ABAC expresses conditions such as clearance, nationality, project, and device posture without creating a new role for each combination.
What is a policy enforcement point (PEP)?
A policy enforcement point is the component that intercepts a request and applies the authorization verdict, allowing the action, blocking it, or releasing a decryption key. It does not decide anything itself; it asks a policy decision point and enforces the answer. A correct PEP is fail-closed, denying the request when the decision service is unavailable rather than defaulting to permit.
How do you control what an AI agent can access on a user's behalf?
Give the agent its own identity and evaluate each action against policy rather than issuing a broad standing token. Delegation chains form quickly when agents call tools that call other agents, so the authorization decision must include the original requester, the acting agent, the resource, and the purpose. Scope and duration should shrink to the specific task.
