Is there a common system or pattern that combines the permissions given by a role in a RBAC-system with permissions in relation to dataownership?
Bob is a doctor and has the role with the privilege 'view patient details'
but only if 'patient is assigned to doctor Bob'
the above example places the relation on the Actor (Doctor Bob in this case) but I'm actually looking for group-based solution:
Bob is a doctor and has the role with the privilege 'view, patient details'
Bob is a member of group 'A'.
Bob can view all patient details for patients assigned to group 'A'
My question is
Is there any common access model that does the above?
summary of the answer(s) I found
There seem to be two more or less related solutions for this scenario: Parameterized RBAC (pRBAC) and Object-Sensitive RBAC (ORBAC). The pRBAC solution has, from what I could find, generated more interest than ORBAC. In my opinion, it is also the more elegant and flexible of the two solutions.
There are other lines of research out there that look to solve the same access control issue, but those are aimed at replacing RBAC with some other type of Access Control model.