When every exception becomes a new role, you need attributes
If your permission matrix keeps growing a new role for every customer exception, that is usually a modeling problem, not a staffing problem. RBAC is great when access follows a stable job function: editors edit documents, admins manage the workspace. It starts to crack when the real rule is conditional. "Editors in the EU can edit GDPR-tagged docs during business hours" is not three more roles.…
When a permission matrix begins to grow a new role for every customer exception, that is typically a modeling issue, not a staffing problem. Role-Based Access Control (RBAC) is effective when access follows a consistent job function, such as editors editing documents and administrators managing the workspace. However, when the real rule is conditional, RBAC begins to break down.
For example, editors in the European Union (EU) who can edit GDPR-tagged documents only during business hours should not require three additional roles. Instead, it's a matter of evaluating user, resource, and environment attributes. To determine who can access a particular object at any given moment, one should not need to invent a new role name.
Instead, these conditions should be moved to attributes and evaluated at request time. Roles should be reserved for the broad base, while the changing facts (such as plan, region, classification, and ownership) should be placed beside the decision, not within another role string.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
