ABAC
An access control model that combines identity, resource, action, and environmental context as dynamic variables to determine the legitimacy of access requests. Compared with RBAC, it enables finer-grained permission control and is suited to complex, dynamic authorization scenarios.
Timeline (last 90 days)
Dynamically computing the available permission set based on the Agent's current task context using RBAC or ABAC can significantly reduce the risk of lateral movement after an Agent is compromised by a prompt injection attack.
Deterministic rules typically correspond technically to models such as access control lists (ACL), role-based access control (RBAC), or attribute-based access control (ABAC).
The appropriate authorization approach for Agent systems is layered composition: use RBAC or ReBAC to define resource boundaries, supplement with ABAC for contextual conditions, and then use an intent layer for dynamic narrowing
ABAC is more flexible than RBAC, but the complexity and difficulty of debugging policies increases significantly, and permission predictability decreases
ABAC (Attribute-Based Access Control) makes access decisions by evaluating attributes of the subject, resource, action, and environment
Compared to Role-Based Access Control (RBAC), ABAC can express an agent's access permissions when executing a specific task with greater granularity.
The ideal architecture for cross-engine governance should include a unified metadata catalog, centralized permission control based on RBAC or ABAC, and audit capabilities spanning the entire chain
RBAC binds permissions to predefined roles, while ABAC dynamically computes permissions based on user, resource, and environment attributes; both struggle to precisely describe the dynamic permission requirements of AI Agents.
Traditional RBAC or ABAC models struggle to precisely describe the dynamic permission requirements of AI Agents.
ABAC (Attribute-Based Access Control) makes decisions by evaluating subject attributes, object attributes, environment attributes, and operation types, offering far greater flexibility than RBAC but also significantly increased complexity.
5 more timeline events
All Facts (15)
Traditional RBAC or ABAC models struggle to precisely describe the dynamic permission requirements of AI Agents.
60%UnverifiedDynamically computing the available permission set based on the Agent's current task context using RBAC or ABAC can significantly reduce the risk of lateral movement after an Agent is compromised by a prompt injection attack.
50%UnverifiedDeterministic rules typically correspond technically to models such as access control lists (ACL), role-based access control (RBAC), or attribute-based access control (ABAC).
50%UnverifiedThe appropriate authorization approach for Agent systems is layered composition: use RBAC or ReBAC to define resource boundaries, supplement with ABAC for contextual conditions, and then use an intent layer for dynamic narrowing
50%UnverifiedABAC is more flexible than RBAC, but the complexity and difficulty of debugging policies increases significantly, and permission predictability decreases
50%UnverifiedABAC (Attribute-Based Access Control) makes access decisions by evaluating attributes of the subject, resource, action, and environment
50%UnverifiedCompared to Role-Based Access Control (RBAC), ABAC can express an agent's access permissions when executing a specific task with greater granularity.
50%UnverifiedThe ideal architecture for cross-engine governance should include a unified metadata catalog, centralized permission control based on RBAC or ABAC, and audit capabilities spanning the entire chain
50%UnverifiedRBAC binds permissions to predefined roles, while ABAC dynamically computes permissions based on user, resource, and environment attributes; both struggle to precisely describe the dynamic permission requirements of AI Agents.
50%UnverifiedABAC (Attribute-Based Access Control) makes decisions by evaluating subject attributes, object attributes, environment attributes, and operation types, offering far greater flexibility than RBAC but also significantly increased complexity.
50%UnverifiedRole-Based Access Control (RBAC) has difficulty expressing rules such as 'only the author of an article can delete their own article,' which gave rise to Attribute-Based Access Control (ABAC).
50%UnverifiedThe two-tier access model integrates RBAC and ABAC permission models while introducing a time dimension (token validity period) and a behavioral dimension (operation type restrictions), forming a new permission paradigm suited to Agent scenarios.
50%UnverifiedThe principle of least privilege requires that each user or service be granted only the minimum permissions necessary to complete a specific task, and in practice must be implemented in conjunction with RBAC, ABAC, and regular permission audits.
50%Unverified以家庭为单位的健康应用若缺乏细粒度隐私控制反而可能成为家庭矛盾的导火索，需要 RBAC/ABAC 等访问控制机制并考虑代理同意与监护权等法律议题
50%UnverifiedABAC（基于属性的访问控制）可通过OPA（Open Policy Agent）等策略引擎动态评估多维度条件，实现RBAC静态角色绑定无法实现的动态决策
50%