Create an ABAC Policy

Attribute-Based Access Control (ABAC) decides access based on attributes of users, resources, and the environment. Use ABAC when roles alone can't express your rules, for example when access depends on a department, a training status, or a document's classification.

Understanding the scenario

Imagine you're managing a secure company network.

To protect intellectual property, you want to ensure that only employees in the R&D department who have completed mandatory cybersecurity training can access high-priority classified project documents.

Roles alone can't express this rule, so you use ABAC, with conditions on user and resource attributes.

In this guide, you build that ABAC policy step by step.

1

Create User Attributes

User attributes describe who the user is. Your policy conditions test them.

• Department: Which department the user belongs to.
• Training Status: Whether the user has completed cybersecurity training.

User attribute values usually come from your identity provider (for example Okta, Auth0, or Clerk), which stores details such as department or certification status and provides them when the user authenticates.

• Attribute 1: department (e.g., "R&D", "Sales").
• Attribute 2: training_status (e.g., "completed", "pending").

To set user attributes, go to Directory > Settings > User Attributes and then Add Attribute.

2

Create Resource Attributes

Resource attributes describe the resources you control access to. In this example, the resources are project documents, and the attributes record their priority and type.

• Priority Level: Classifies documents as "high", "medium", or "low" priority.
• Document Type: Specifies the document category (e.g., "classified", "public").

Navigate to the Resources Panel, select Resource Attributes, and add these:

• Attribute 1: priority_level (e.g., "high", "medium").
• Attribute 2: document_type (e.g., "classified").

To set resource attributes, go to Policy > Edit Resource (if one exists) > ABAC Options and then Attributes.

3

Define a Dynamic Role (User Set)

A dynamic role (user set) groups users by their attributes, so a policy applies to every user who matches. For this example:

Create a User Set that includes employees from the R&D Department who have completed cybersecurity training.

Navigate to User Sets and configure the conditions:

• department equals Engineering.
• training_status equals certified.

4

Define a Dynamic Resource (Resource Set)

A dynamic resource (resource set) groups resources by their attributes. For this example:

Define a Dynamic Resource for high-priority classified documents.

Navigate to Dynamic Resource and configure the conditions:

• priority_level equals high.
• document_type equals classified.

5

Create your policy rules

Policy rules link user sets, resource sets, and actions to enforce access control.

Define an Engineering user as someone permitted to read standard documents but restricted from accessing highly classified documents. In contrast, an R&D Certified Employee is allowed to read both standard documents and High Priority Classified Documents.

What did you learn?

You created an Attribute-Based Access Control (ABAC) policy step by step: attributes, a user set, a resource set, and the rules that connect them.

When a user's or resource's attributes change, their access changes with them, without new role assignments.

What's next? 🎉

• Define resource relations and parent-child structures
• Configure role derivations to automate access
• Set up permissions to enforce your policy rules

You are now a master of ABAC!