Dear all members of Information Security, this is my first post here and I hope I came to the right place. I am currently studying about access control techniques and I am struggling to visualize and conceptualize the ideas.

Following is a set of techniques I have been reading about:

  1. Access Control Matrix
  2. Access Control Lists
  3. Access Control Capability
  4. Role-Based Access Control
  5. Rule-Based Access Control

I feel comfortable with [1][2] and [3]; partially comfortable with [4] and completely lost with [5]. What I mean by comfortable is that I understand basic concept behind the technique but don't have a practical example of an implementation.

I would be happy with a clear definition which could assist me in visualizing these ideas. Ideally, I would be interested in visual type of information which could assist me to establish conceptual understanding. Bonus, if someone could describe concise practical example.

2 Answers 2


Rule based access means that your privileges are computed based on rules. The rules are logical formulas based on 1) user attributes like: job position, clearance level, job title, job description, geographical location and so on and/or 2) physical things like ip address you log on from, weekday, whether you're on vacation or not, ...
You're a power user of software product ABC. The product uses rule based access. You have some strong privileges that allow you to do XYZ on objects which are assigned to the same geographical region that you work in. These privileges are only effective if:

  1. your client IP is in some IP range (which excludes doing stuff from at home through VPN)
  2. It is monday - friday between 8am and 6pm.

So the rule to be granted a certain privilege would be in this example

ip == and workday <= friday and workday >= monday and timeofday <= 6pm and timeofday >= 8pm

and such a rule could also check things like job position, which is relatively straightforward if it is an alphanumeric code from the HR system which immediately identifies you as poweruser for that particular product.


To add to @kaidentity's excellent description of number 5 ...

Role Based Access Control

Allows or denies access to resources based on your job role.

A common example is in banking. A bank teller will have access to front-of-bank systems for checking accounts and giving out cash up to a certain amount. A bank manager will have access to back-office systems and perhaps permissions to authorise larger amounts of cash.

More advanced RBAC systems are more dynamic. So a teller may be "promoted" to a bank manager for a day or two when the actual manager is off. Or they may get some other temporary role such as access to the mortgage system.

An excellent example of the failure of an RBAC is when someone is accidentally given access to two roles that should be mutually exclusive such as making and authorising £10m+ trades. Whereas any RBAC system will do basic roles, far fewer are sophisticated enough to do exclusive roles.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .