IndyKite Knowledge-Based Access Control (KBAC)

Authorization is a foundational IAM capability that determines who can access what resource and in which way, and it should only happen after authentication. Access control has evolved to address rising complexity: ACLs offer a simple “in list or not” approach but break down when requirements become nuanced. RBAC improved manageability by grouping permissions into roles, yet its reliance on role aggregation can produce “role explosion” if not carefully designed. ABAC introduced runtime, attribute-driven decisions using subject, object, action, and environment signals, often associated with XACML’s policy language and architecture; while XACML itself did not gain broad adoption, ABAC re-emerged as PBAC, accelerated by modern tools like OPA and Rego for cloud-native environments. Additional models such as RAdAC add risk and situational awareness into decisions, but growing maintainability and security demands suggest a further step.

A proposed next stage is Relationship-Based Access Control (ReBAC), implemented here as IndyKite’s Knowledge-Based Access Control (KBAC), which uses an Identity Knowledge Graph to model relationships and context among people, devices, bots, APIs, and services. Rather than centralizing customer databases, IndyKite focuses on metadata describing relationships and contextual signals, continuously updating these connections as conditions change; access is effectively granted by traversing valid relationship paths in the graph. The graph structure supports ML-driven intelligence such as clustering, similarity detection, and anomaly discovery (including missing expected relationships). The platform also supports enriched querying, semantic extraction from identity data, and insights for recommendation, discovery, and personalization, alongside consent, verification, and zero-trust actions.

IndyKite provides SaaS-based authorization APIs, SDKs, connectors for ingesting customer data, optional local OPA for edge/distributed use cases, and additional compliance/security measures for PII. Strengths include extensibility, integration with existing IAM/SSO, and broader security decision support; challenges include an emerging market, SaaS-only delivery, certifications in progress, and developing auditability/visibility for decision explanation.

• Authorization decisions should occur only after an identity has been authenticated.
• ACLs grant access based on whether a subject is on a list associated with a resource.
• RBAC maps roles to permissions and privileges to simplify administration compared to ACLs.
• ABAC evaluates subject, object, action, and environment attributes against policy rules at runtime.
• XACML defined a standardized policy language, architecture, and processing model associated with early ABAC implementations.
• XACML did not achieve widespread adoption, while ABAC concepts shifted into PBAC approaches.
• OPA and Rego have driven renewed PBAC adoption in modern architectures such as containers and Kubernetes.
• IndyKite’s KBAC uses an Identity Knowledge Graph to express relationships and context among entities for authorization decisions.
• IndyKite offers connectors/plugins and a data ingest engine to consume customer data sources for access decisions.
• General availability targets were Q4 2022 for SOC 2 and Q2 2023 for ISO 27001.

• “Authorization is a simple access control concept - deciding who has what type of access to a resource.”
• “RBAC's strength of aggregation under a role label also has its downside.”
• “Roles must be carefully planned and managed lest they become unwieldy and subject to role explosion.”
• “PBAC has become the de facto approach to authorization today.”
• “But is this enough?”
• “One approach worthy of consideration is Relationship-Based Access Control (ReBAC), where access is granted based on relationships between identity data and context.”
• “IndyKite's Identity Knowledge Graph is not a data lake, nor does it try to synchronize existing customer data sources or build up static data models in LDAP or SQL database, for example.”
• “That ability to traverse between data points is what grants access to resources.”
• “A graph database - the representation of the data in the form of a graph - is well suited to intelligence algorithms in which SQL or LDAPs cannot be applied.”
• “IndyKite offers an innovative approach that examines the changing context of relationships between identities and other data sources, addressing the more complex access control use cases we see today.”