ABAC Components
Learn the four components of an attribute-based access control (ABAC) decision and how each one maps to Permit.io. This page is for developers who are planning which attributes their ABAC policy needs.
An ABAC policy decides access based on the attributes of four components of each access request: the subject, the resource, the action, and the environment. The examples on this page follow one employee, Jessica, through a single request.
| Component | Question it answers | In Permit |
|---|---|---|
| Subject | Who is making the request? | The user, with user attributes (and the attributes of the user's tenant) |
| Resource | What does the subject want to access? | The resource, with resource attributes |
| Action | What does the subject want to do? | An action defined on the resource |
| Environment | In what context is the request made? | Context values, such as the current time, passed as attributes in permit.check() |
Subject and subject attributes
The subject is the user who requests to perform an action on a resource. Subject attributes can include an employee ID, a job title, group memberships, a department, a management level, and a security clearance.
Your application often gets these values from the authentication token at sign-in, or from an HR system or directory.
In Permit, subject attributes are user attributes. You can also use tenant attributes of the user's tenant. You group users by attribute values into user sets (dynamic roles). To create user attributes, see Step 1 of Building your first ABAC policy.
Jessica is an employee of Acme. Her job title is Product Manager. She belongs to the marketing and community management groups. She works Monday to Friday, from 9am to 5pm. She is responsible for product expenses and has access to the company credit card.
Resource and resource attributes
The resource is the object the subject wants to access, such as a file, an application, a server, or an API. Resource attributes describe the resource, such as a file's creation date, owner, name, type, and data sensitivity.
In Permit, you define resource attributes on the resource, and group resources by attribute values into resource sets (dynamic resources). To create a resource with attributes, see Step 4 of Building your first ABAC policy.
A company credit card owned by Acme with strict spending limits.
Action
The action is what the subject wants to do with the resource, such as read, write, edit, copy, or delete. Actions can also be specific to your application, such as subscribe or approve.
In Permit, you define the actions of each resource, and grant a user set the actions it can perform on a resource set. See Step 6 of Building your first ABAC policy.
Jessica wants to use the company credit card to subscribe to a membership plan that gives co-workers access to internal tools.
Environment
The environment is the context of the access request: the time and location of the request, the subject's device, the network, and the communication protocol.
Environment attributes in ABAC are not the same as Permit environments (such as development and production). In Permit, you pass context values as attributes in the permit.check() call, for example the current time as a user attribute. For an example, see the time-based role example.
Jessica can use her company credit card to buy a subscription only during her working hours, while she is in the USA and connected to the company network.
Next steps
- Building your first ABAC policy: create attributes, a user set, a resource set, and permissions.
- Defining attributes: set attribute values in the dashboard, through the API, or in
permit.check(). - ABAC design patterns: ownership and group membership with attributes.