ABAC
Attribute based access control, or ABAC, is an authorisation model in which access decisions are computed at request time from attributes of the user, the resource, the action and the context, rather than read from a static role. The policy is a rule, and the answer can differ for the same person from one request to the next.
The mechanical difference from role based access control is where the condition lives. A role grants a fixed set of permissions to whoever holds it; an attribute policy says that a user in this department, on a managed device, during working hours, may read a document classified at this level. Location, device state, data classification and time of day become inputs to authorisation instead of being handled by creating another role.
It solves role explosion and buys a different problem: nobody can say what a given user can reach without evaluating the policy. Reviewing access becomes a question about rules rather than a list, and the tooling for that is weaker in most estates than the tooling for group membership.
Where this shows up in practice is in cloud policy languages and in modern access proxies, which are attribute based whether or not anyone calls them that: a condition on a policy statement is an attribute rule. The finding we write most often is not that the model is wrong but that a permissive rule was added to unblock a deployment and never narrowed, and because it is expressed as a condition rather than as a group, no access review ever looked at it.