Access Control Models: RBAC, ABAC & Least Privilege¶

Once you know who a user is, you must decide what they can do. That's access control.

The Models¶

DAC — Discretionary Access Control¶

Resource owners grant access at their discretion (e.g., file permissions, sharing a doc). Flexible but error-prone at scale.

MAC — Mandatory Access Control¶

The system enforces access based on classification labels (e.g., Secret, Top Secret) — users can't override. Used in military/SELinux contexts.

RBAC — Role-Based Access Control¶

Permissions are assigned to roles; users get roles. The workhorse of enterprise apps.

User → Role(s) → Permissions Alice → "Editor" → [read, write articles] Bob → "Admin" → [read, write, delete, manage users]

Benefits: scalable, auditable, easy onboarding/offboarding by role.

ABAC — Attribute-Based Access Control¶

Decisions use attributes (user dept, resource sensitivity, time, location, device posture). Most flexible; powers fine-grained and zero-trust policies.

ALLOW if user.dept == resource.dept AND user.clearance >= resource.level AND request.time in businessHours

Least Privilege & Need-to-Know¶

• Grant the minimum access required, for the shortest time needed.
• Just-in-Time (JIT) access: elevate privileges temporarily, then auto-revoke.
• Privileged Access Management (PAM): vault, broker, and record admin sessions.

Identity Governance¶

Privilege creep — users accumulating access over years — is a major risk. Regular access reviews are the cure.

Service & Machine Identities¶

It's not just humans. Services, containers, and CI pipelines need identities too:

• Use short-lived credentials and workload identity instead of long-lived static keys.
• Never embed long-lived secrets in code or images (Chapter 9).
• Rotate and monitor machine credentials like human ones.

The Zero-Trust Tie-In¶

Zero Trust depends on strong identity + fine-grained authorization + continuous verification. RBAC gives you the baseline; ABAC and device posture checks give you the precision Zero Trust requires.