What is attribute-based access control (ABAC)?

ABAC is access control in which a relying party authorises access to a resource on the basis of one or more attributes of the subject.

Compared with RBAC it can use any attribute (department, clearance, age, location, time) rather than a fixed role assignment, which makes fine-grained and context-dependent rules possible at the price of more complex policies.

Go deeper:

• Attribute-based access control (Wikipedia) — policies over subject, resource and environment attributes.
• NIST SP 800-162 Guide to Attribute Based Access Control — the reference definition of ABAC and how it differs from role-based control.