Authorization models: RBAC and ABAC
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
choose between role-based and attribute-based access control, or combine them.
Planned topics
- RBAC: permissions attach to roles, people get roles; simple to explain and audit.
- ABAC: decisions use attributes of the user, resource, and context, such as "store manager of the same store".
- Pure RBAC leads to role explosion when rules depend on store, region, or time.
- A common design: coarse roles plus attribute rules for scope.
Draft outline details
Demonstration
a table comparing RBAC and ABAC with the Larkspur rule "a store manager sees returns only for their own store" implemented as role StoreManager plus attribute storeId equal.
Check your understanding
Why does role explosion happen?
Show answer
Every combination of scope and permission becomes its own role, such as "Manager-Store-014".
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.