CodePark/ questions / Access control (RBAC, ABAC, IDOR)
START PRACTICINGPRACTICE
Backend question · Auth & security › Access control (RBAC, ABAC, IDOR)

The rule is: "Doctors may view a patient's record only if the patient is in their department and they are currently on shift." Which model expresses this most naturally?

ABAC, because the decision depends on attributes of the user, the resource and the environment

ABAC (attribute-based access control) fits best. It checks attributes in a policy, such as user.department, record.department and the current time. This matches the rule directly.

"RBAC, by giving all doctors a viewRecords role" is wrong. RBAC is role-based access control. A doctor role can't express department matching or time of day. You would need a huge number of roles, like cardiology-doctor-on-shift.