Moving to Attribute-Based Access Control

In this lesson, you will learn how to evolve your authorization logic from static role-based checks to flexible, policy-driven Attribute-Based Access Control (ABAC).

Moving Beyond Roles

Up until now, you have likely used Role-Based Access Control (RBAC), where a user has a single role (like admin or editor). While simple, RBAC often suffers from "role explosion" when requirements get complex—like needing to restrict an editor to only work during business hours or only on documents they created.

ABAC solves this by evaluating a request based on three sources of truth:

1. User Attributes: Who is the user? (e.g., department: 'finance', clearance: 'level-2')
2. Resource Attributes: What are they accessing? (e.g., ownerId: '123', isSensitive: true)
3. Environmental Context: What is the situation? (e.g., currentTime, ipAddress, deviceType)

Implementation Strategy

Instead of checking if (user.role === 'admin'), you define a policy that evaluates these attributes. In your Node.js middleware, this looks like a logic engine that compares incoming request data against a set of rules.

const canEditDocument = (user, document, context) => {
  // Policy: Users can edit if they are the owner OR they are an admin 
  // during standard working hours.
  const isOwner = user.id === document.ownerId;
  const isAdmin = user.role === 'admin';
  const isBusinessHours = context.hour >= 9 && context.hour <= 17;

  return isOwner || (isAdmin && isBusinessHours);
};

// Usage in middleware
app.post('/docs/:id', (req, res) => {
  const context = { hour: new Date().getHours() };
  if (canEditDocument(req.user, req.document, context)) {
    // Proceed with logic
  } else {
    res.status(403).send('Access Denied by Policy');
  }
});

By decoupling the permission logic from hardcoded roles, your system becomes significantly more granular. You no longer need to create a new "Manager-In-Finance-During-Hours" role; you simply update the policy logic to account for those specific attributes. This approach is highly scalable and mirrors real-world security requirements more accurately than simple role checks.

Key Takeaway: ABAC shifts authorization from static identity labels to dynamic policy evaluations based on user, resource, and environmental attributes.