Attribute Based Access Control (ABAC) and Role Based Access Control (RBAC) are similar in that they both seek to control data access based on the business reasons why a person should receive access, rather than simply a list of people.
RBAC is simpler than ABAC. It is essentially the same idea, but it is one-dimensional. For example, it can grant access to ‘Role=Manager’, but the rule can’t be made more specific using a second dimension, as in ‘Role=Manager and Office=Paris’. ABAC can include theoretically as many dimensions as needed.
Without the additional power of ABAC, organisations typically either tolerate access being widely and inaccurately available to people who shouldn’t have it, or revert back to using manual lists-based access.
