Access Control Explained: RBAC, ABAC, Object Ownership, and Deny-by-Default

Access Control Explained: RBAC, ABAC, Object Ownership, and Deny-by-Default

Access control decides whether an authenticated principal may perform a specific action on a specific resource.

Deny by Default

If no explicit rule grants access, deny it. A missing authorization rule should never silently become permission.

Check Every Request

Do not authorize only at login or UI navigation. Every protected operation must re-evaluate permission using trusted server-side identity and resource data.

Example:

DELETE /projects/42

The backend should verify both:

Can this user delete projects?
AND
May this user delete project 42?

RBAC, ABAC, and ReBAC

RBAC uses roles such as admin, manager, or viewer. It works well when permissions map cleanly to job functions.

ABAC considers attributes such as tenant, department, resource sensitivity, environment, or time/context.

ReBAC bases access on relationships—for example user is editor of document or member belongs to workspace.

Real systems often combine these models.

Never Trust Client Identity Fields

Do not authorize from client-controlled values such as:

{"role":"admin","tenant_id":99}

Resolve identity, tenant, roles, and relationships from trusted session/token/backend state.

Random or UUID object IDs can reduce guessing but do not replace object-level authorization.

Apply Least Privilege

Grant only the actions and resources required. Separate high-risk operations such as billing, credential management, destructive infrastructure actions, or role administration from ordinary user permissions.

Test Authorization as Business Logic

Create unit/integration tests for:

• cross-tenant access
• horizontal privilege escalation
• vertical privilege escalation
• missing/expired roles
• deleted membership
• default-deny behavior

Authorization bugs are often logic bugs, so automated policy tests matter.

Final Takeaway

Strong access control means trusted identity + explicit resource/action policy + deny-by-default + per-request enforcement. Roles are useful, but ownership, tenant relationships, and contextual attributes often matter just as much.

References

• OWASP Authorization Cheat Sheet
• OWASP Developer Guide: Access Controls