Authorization terminology is a mess: Let's fix it
Source Entity
Hacker News
Andrea Chiarelli argues that current authorization terminology conflates the 'what' of access control with the 'how' of policy management. The analysis seeks to clarify the distinction between logic-based models like RBAC/ABAC and centralized architectural approaches like PBAC.
The Authorization Taxonomy Crisis
In the rapidly evolving landscape of cybersecurity, the terminology surrounding access control has become increasingly fragmented. Andrea Chiarelli’s recent commentary highlights a fundamental misunderstanding in how industry professionals categorize authorization frameworks. By conflating different structural approaches, engineers often struggle to implement robust security architectures, leading to confusion when selecting the right tools for their infrastructure.
Distinguishing the 'What' from the 'How'
At the heart of Chiarelli’s critique is the distinction between the data source of a decision and the execution mechanism of that decision. Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) are essentially taxonomies of data; they define the inputs—roles or specific attributes—that dictate whether a user is granted access. These models describe the 'what' of the security rule, focusing on the specific parameters that define a user's permissions.
The Role of Policy-Based Access Control (PBAC)
Conversely, Policy-Based Access Control (PBAC) represents an architectural shift regarding the 'how.' It defines where the decision-making logic resides—specifically within a centralized policy engine rather than being hard-coded into the application logic. Chiarelli’s analogy of comparing a 'recipe' to a 'kitchen' perfectly illustrates the category error: RBAC/ABAC are the ingredients of the rule, while PBAC is the facility that prepares and serves that rule to the application.
Why the Confusion Persists
This terminological overlap persists because vendors and architects often treat these models as mutually exclusive choices. In practice, organizations frequently implement PBAC to manage rules that are themselves based on RBAC or ABAC structures. By failing to separate the architectural implementation (PBAC) from the logical formulation (RBAC/ABAC), companies often create brittle, hard-to-manage security systems that fail to scale with modern cloud-native requirements.
Broader Implications for Security Architecture
When architects treat these as competing options, they risk building systems that are either overly centralized or unnecessarily rigid. The industry trend toward decoupling security logic from application code is a positive evolution, but it requires a standardized vocabulary. Without a clear distinction between the 'shape' of a rule and the 'location' of its evaluation, security teams will continue to struggle with interoperability and policy governance.
Future Trends in Authorization
As organizations move further toward zero-trust architectures, the demand for clear, centralized policy management will only grow. The future of authorization lies in the intelligent integration of these models—using attributes and roles to inform the decision, while utilizing policy engines to enforce those decisions consistently across microservices. Fixing the terminology is the necessary first step to simplifying the complex task of enterprise-grade access management.