Authorization interview question · Most asked
Compare RBAC, ABAC and ReBAC authorization models.
Summary
RBAC grants permissions to roles assigned to users; ABAC evaluates policies over attributes of the user, resource, action and context; ReBAC (relationship-based) derives access from relationships in a graph, like 'editor of the folder containing this document'.
Longer Answer
RBAC is simple and auditable but leads to role explosion for fine-grained rules. ABAC handles rules like 'managers can approve expenses under $5k in their department during business hours'. ReBAC (Google Zanzibar, OpenFGA, SpiceDB) models sharing and hierarchies (orgs → teams → projects → documents) naturally. Many real systems combine them: roles for coarse access, relationships or attributes for resource-level checks.
Key Points
- RBAC: roles → permissions
- ABAC: attribute policies
- ReBAC: relationship graph
- Combine models in practice
Comparison / Tradeoffs
| Model | Strength | Weakness |
|---|---|---|
| RBAC | Simple, auditable | Role explosion |
| ABAC | Context-rich rules | Harder to audit |
| ReBAC | Sharing & hierarchies | Needs a relationship store |