BlueHomer
ABAC (attribute-based access control)
RBAC grants access by role; ABAC decides using attributes of the user, data and context. Together with row and field controls, they reach the data rather than just the API.
Definition
Role-based access control (RBAC) grants permissions to roles and assigns people to those roles. Attribute-based access control (ABAC) decides each request using attributes of the user, the data and the context — clearance, classification, department, purpose, location, time. Most enterprises need both: roles for structure, attributes for the exceptions roles cannot express.
Why it matters
- Role explosion is what happens when every exception becomes another role.
- Access control that stops at the API still exposes every row and field behind that endpoint.
- AI agents make this urgent: an agent acting on your behalf must inherit exactly your restrictions, field by field.
How BlueHomer implements it
BlueHomer combines RBAC with ABAC and pushes enforcement down to the data — field-level masking and row-level filtering — so the same query returns different, correct results for different users, and an AI agent executing under a user’s identity can never see more than that person could.
Frequently asked questions
Should we use RBAC or ABAC?
Use roles for the stable structure of an organization and attributes for the conditions roles cannot express — classification, purpose, context. Choosing only one usually ends in either role explosion or policy that cannot be reasoned about.