What is PBAC?

Policy-Based Access Control (PBAC) is a dynamic approach to manage access control in complex environments. It utilizes a policy engine and a policy definition language (Cerbos uses simple YAML) to articulate and enforce access rules. In PBAC, policies define the criteria for access and are managed using standard software development lifecycle tools, offering a scalable and adaptable solution for varying access control needs.

Why Choose PBAC?

• Flexibility and scalability: Adapt to changing access needs with ease.
• Granular control: Define access based on multiple conditions and contexts.
• Integration with development tools: Manage policies using familiar software development practices.

PBAC in action with Cerbos

        
      
      
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: pbacExample
  rules:
    - actions:
        - VIEW
      effect: EFFECT_ALLOW
      roles:
        - USER
      condition:
        match:
          all:
            of:
              - expr: request.principal.attr.department == "IT"
              - expr: request.resource.attr.type == "confidential"

In this PBAC policy, access to confidential resources is granted based on the principal’s attributes pf department and the resource type. This showcases how PBAC allows for highly granular and context-specific access control.