Authorization frameworks comprise run-time policy enforcement, administration-time policy models, and IAM governance. Groups are the dominant policy model in the enterprise today. Easy to manage from the bottom up, the problem is that groups tend to sprawl. Turning to RBAC, some organizations have a good set of positional roles, but others don't. Either way, RBAC easily succumbs to role proliferation if practicioners layer too many special cases and exceptions onto the model. Fortunately, dynamic authorization - also known as attribute-based access control (ABAC) - has the potential to blend roles, groups, and attributes from subjects, resources, and context into a unified model.
Key Takeaways:
