IAM Chapter 6: The Whole Machine

Part of the IAM study series.

A short stop before Kerberos, to put Part 1 and Part 2 together.

RBAC and ABAC are models: what the rule looks like. PEP, PDP, PIP, and PAP are architecture: who does the work. They answer separate questions, and the components run whichever model you wrote.

John Opens drawing-7742

At grant time, months earlier, nothing happens while John is clicking:

HR records job code DE-03 in department WING-ASSY.
IGA assigns the business role Design Engineer – Wing Assembly from that HR data.
The business role brings its application roles in PLM and TeamCenter.
The result is an entitlement: John is in PLM-WingEngineers.

Separately, export control writes a policy in the PAP, tests it, approves it, and publishes it:

PERMIT read ON drawing
  WHEN  "wing-design-engineer" IN subject.roles        ← RBAC
  AND   resource.classification == "export-restricted" ← ABAC
  AND   subject.clearance.validUntil > now             ← ABAC
  AND   environment.country IN approvedCountries       ← ABAC

At access time, Thursday 14:32, all of this happens in one request:

John requests the drawing, and the PEP in front of PLM's API intercepts it.
The PEP asks the PDP, sending subject, action, and resource.
The PDP fetches each fact from the PIP that owns it: country and device from the network, clearance from HR, classification from PLM, roles from the directory.
All four conditions hold, so the PDP answers PERMIT.
The PEP lets the request through, and PLM returns the drawing.

Change any one fact and the same policy answers DENY, with nobody editing anything.

The Link Worth Memorising

People talk about RBAC and ABAC as rival models. In a real system the role is just another attribute. The directory is another PIP, and "wing-design-engineer" is one condition among four. They don't sit side by side: the role is an input to the policy.

What Each Piece Is For

Question	Answered by	When
Should John ever touch wing drawings at all?	RBAC, through his job	Grant time
May he touch this drawing, right now, from here?	ABAC, through the policy	Access time
Who asks and enforces?	PEP, the guard	Access time
Who decides?	PDP, the control room	Access time
Where do the facts come from?	PIP, the phone numbers	Access time
Who wrote and approved the rule?	PAP, the office	Before any of it
Who granted the role, and who reviews it?	IGA	Grant time

Drop One Piece, and Something Specific Breaks

Missing	What breaks
RBAC	The joiner has nothing on day one, and there's no list to recertify
ABAC	Export control can't be enforced, because context is invisible
PEP/PDP split	The rule drifts across 200 apps, each a different version
PAP	Whoever runs the engine can grant themselves anything, and it audits clean
PIP	The PDP keeps its own stale copy of the facts
IGA	Nobody can answer what John has, or take it away

So far John has simply been logged in. The next part looks at how that actually happens.

🔴 CHECKPOINT: Study Notes

IAM Chapter 6: The Whole Machine, handwritten one-page map of RBAC, ABAC, IGA and the policy components from grant time to access time

← Previous: Deciding at the Door · Back to the series start · Next: Kerberos →