While reading a number of definitions of attribute-based access control (ABAC), I found that there are two different definitions:
Access control decisions are made using the attributes of users, objects and the environment.
Access control decisions are made using the attributes of users and objects (although environment attributes are not mentioned in this definition, they form part of the user's attribute e.g. user's location).
So I wanted to know, in information security, which definition is recognised as the standard definition of ABAC?