Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
When is ABAC (Attribute-Based Access Control) needed in addition to RBAC, rather than RBAC alone being sufficient?
💻 Code Challenge | +75 XP
Implement an ABAC policy function for expense approval requiring the resource submitter to be a direct report of the subject, the amount to be under a threshold, and the request to occur during business hours, with unit tests covering each condition.
A manager was able to approve an expense report submitted by an employee outside their team, since the approval check only verified the manager role via RBAC with no attribute-based ownership or relationship check. Reorder the steps to add the missing ABAC layer.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Relying only on RBAC for an authorization decision that genuinely depends on contextual attributes RBAC cannot express
// Insufficient: RBAC alone can't express the relationship requirement
requirePermission("expenses:approve") // ANY manager, ANY report
// Correct: ABAC captures the actual, needed relationship
if (!(expense.submittedBy in manager.directReports)) return res.sendStatus(403);The Solution //
A rule like "a manager can approve expenses only for their own direct reports" involves a relationship between the subject and the resource that a simple role check has no way to represent — RBAC alone would incorrectly allow a manager to approve any expense report, not just those from their own team.
The Error //
Allowing ABAC policies to accumulate excessive, hard-to-reason-about complexity without adequate testing
// Untested complexity is risky to reason about correctly
function canApprove(subject, resource, env) { /* several combined conditions */ }
// Correct: directly, thoroughly unit tested
test("denies approval exactly at the amount boundary", () => {
expect(canApprove(subject, { amount: 5000 }, env)).toBe(false); // boundary case
});The Solution //
As an ABAC policy accumulates more attribute conditions, it becomes genuinely harder to reason about and verify correctness by inspection alone — treating each policy as a pure, directly unit-testable function with explicit test coverage for its specific boundary conditions is essential to maintaining confidence in an increasingly complex policy.