Hacker News Reader

A good backgrounder would be The Laws of Identity https://www.identityblog.com/stories/2005/05/13/TheLawsOfIde...

Thank you!

Maybe this Wikipedia page might get you started:

https://en.wikipedia.org/wiki/Attribute-based_access_control

Thank you!

I don't think you want ABAC. ABAC is for the cases when a set of attributes will grant access. The more common thing is RBAC. RBAC is that a user have been assigned some roles that comes with access.

A good example with ABAC is if person X uses an IPhone with the latest major updates then access to some wi-fi is granted.

Also, roles comes with a hierarchy. This is important when you work with SOX controlled companies.

Several security consultants will try to sell ABAC as a necessity along with RBAC. It is for sure not.

You can start with: https://github.com/kdeldycke/awesome-iam . But beware of the rabbit hole!