Hybrid Role-Based and Attribute-Based Access Control
Definition
Hybrid access control combines roles with additional conditions.
A hybrid access control design that combines role-based base permissions with attribute-based conditions on subject, resource, action, or environment. It is not a single standardized model.
Simply explained
A role generally allows access, but for example only at the correct location or during the appropriate shift.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
The role "Service" may only open customer data for its own location and during the shift.
Limits and pitfalls
- Combining RBAC and ABAC without clear decision logic, leaving precedence rules open, or using untrusted or outdated attributes.
Origin & history
Hybrid approaches combine RBAC with ABAC. NIST SP 800-162 defines ABAC but not a universal hybrid architecture.
Use in mid-sized companies
- Possible example: The role "Service" may only open customer data for its own location and during the shift.
Frequently asked questions
What does Hybrid role- and attribute-based access control mean?
A hybrid access control design that combines role-based base permissions with attribute-based conditions on subject, resource, action, or environment. It is not a single standardized model. What mistakes should be avoided? Combining RBAC and ABAC without clear decision logic, leaving precedence rules open, or using untrusted or outdated attributes.
Sources
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: