RBAC vs. ABAC: Static roles vs. dynamic contextual attributes and Open Policy Agent (OPA).

1. Role-Based Access Control (RBAC):
   [ User: Alice ] ---> [ Role: Editor ] ---> Can Edit Articles (Static)
   Limitation: "Role Explosion" (e.g., RegionalEditor_US, WeekendEditor_EU).

2. Attribute-Based Access Control (ABAC):
   Evaluates boolean policy across Subject, Resource, Action, and Environment:
   "ALLOW Edit IF user.department == resource.department 
              AND request.time >= 09:00 AND request.time <= 17:00 
              AND request.ip IN office_network"

package app.authz

default allow = false

# Allow if user is an admin
allow {
    input.user.role == "admin"
}

# Allow doctors to view medical records only for their assigned patients
allow {
    input.action == "view_medical_record"
    input.user.role == "doctor"
    input.resource.assigned_doctor_id == input.user.id
    input.context.mfa_authenticated == true
}