Identity & Access · Chapter 4
Entitlements, RBAC and ABAC
How permission models actually decay, and why role explosion is a design failure rather than bad luck.
RBAC groups permissions into roles and assigns roles to people. ABAC decides from attributes at request time — department, location, device posture, data sensitivity, time of day. Most real systems are a hybrid, and the interesting question is not which is better but how each one fails.
| Fails by | Looks like | |
|---|---|---|
| RBAC | Role explosion | 1,800 roles for 900 employees; a role per person, in effect |
| ABAC | Unanswerable questions | Nobody can say who can reach a system without running the engine |
| Hybrid | Two sources of truth | A role grants it, a policy denies it, and nobody knows which wins |
Role explosion happens because each exception becomes a new role rather than a policy. It is the accumulated debt of a thousand reasonable one-off decisions, and once you are past a few hundred roles the model no longer describes anything a human can reason about.
Policy-as-code, and why it is worth knowing about
The current direction of travel is externalised authorisation: a policy engine — Open Policy Agent with Rego, AWS Cedar, OpenFGA — that applications call to ask “may this subject do this action on this resource?” The policy lives in version control, gets code review, and can be tested.
- For engineers: this is a genuinely growing specialism and it appears in 44% of the identity job descriptions in this atlas — higher than directory work.
- For auditors: it is a gift. Policy in a repository with commit history and tests is dramatically better evidence than permissions configured by hand in twelve consoles.
- The catch: a policy engine that is not consistently called is decoration. The audit question is not “do you have OPA?” but “which code paths bypass it?”
Segregation of duties, stated usefully
SoD means no single person can both initiate and approve the same consequential action — create a vendor and pay it, write code and deploy it to production unreviewed, grant themselves access and use it. It is one of the few identity controls that regulators test directly, and it is usually implemented as a set of forbidden entitlement pairs.
The audit question that finds real problems: “show me someone who holds both halves of a conflicting pair” — and then check whether the compensating control that was documented actually operates.