Where do I report bugs?

Use the "Give Feedback" button inside the Playground to report issues.

Does it replace Axiomatics products?

No. The Playground is designed for learning, experimentation, and testing small scenarios. For production authorization, Axiomatics provides additional capabilities such as attribute connectors, integration with enforcement points in your applications and more. Learn more: Axiomatics Authorization Platform page

Is my data stored, and for how long?

By default, no. Your policy data stays in your browser while you're logged in and isn't stored on our servers. Sessions stay active for up to 14 days, page reloads and logging out clears everything immediately — so export your work first if you want to keep or continue it later. If you opt in to "Help improve the ALFA Playground," some anonymized policy content may be retained, but it's never linked to you or your account.

Who can use the Playground?

Anyone who wants to learn ALFA and how fine-grained, policy based access control works. Sign up with your company email.

What regulations and frameworks does the Axiomatics Audit & Governance capabilities apply to?

Provable, traceable decisions support compliance work across data privacy and healthcare regulations (GDPR, HIPAA, HL7, CCPA), financial services frameworks (PSD2, DORA, PCI DSS, MiFID II), government and export control (Export Control, ITAR), and security and audit frameworks (SOC 2, NIST 800-53, NIS2). The evidence is yours to map to the specific framework and clause that applies, whether that's your own compliance team's work or done with help from an Axiomatics consultant.

Policy-based Access Control (PBAC)

PBAC, also known as attribute-based access control (ABAC), uses attributes to dynamically enforce access controls according to your policies.

4 min read 2018-08-03

Unlike static forms of authorization, such as role-based access control (RBAC), PBAC enables you to rapidly change entitlements based on new regulations or new corporate policies without auditing and changing roles throughout the organization. This ensures assets cannot be compromised and regulations are met.

Using policies to govern authorization also empowers business owners as they can ensure data, resources, etc, are securely used as a core asset. The Axiomatics Policy Server is the centralized hub for storing and enforcing access control policies.

What is the difference between PBAC and attribute-based access control (ABAC)?

PBAC and ABAC are essentially interchangeable in that they enforce policies using attributes. The key difference in this sense is which “end” of the access control model stack you look at: policies that inform the authorization engine what to do and attributes that inform the authorization engine how to do it.

Standardized vs non-standardized

Policy-based access control from Axiomatics comes as standard with support for a standardized approach to expressing policies. Our ABAC solutions are developed in the standard-based language of eXtensible access control markup language (XACML) which has been approved by the organization for the advancement of structured information.

Policy-based access control solutions that do incorporate the ABAC model – i.e., non-standardized solutions – can expose you to vendor lock-in for authorization management.

Can PBAC be used to support large and complex organizations?

Standards-based PBAC is designed specifically to support organizations that have complex authorization requirements. Typically, larger organizations have areas of their business where roles will not suffice as a secure method for securing sensitive data. Administrating roles becomes a major drain on resources while proving virtually impossible to ensure compliance. Using policy-based authorization simplifies and strengthens organization-wide access control for developers, auditors, business owners, and IT security teams.

Key considerations for PBAC

Policy-based access control is not a quick fix. It takes time and resources to get it right, but once deployed will provide savings and deliver the data security you need.

Start small and expand: Unless you are starting from scratch, you will already have an advanced authorization solution in place. Ripping it all out and starting again is a major undertaking, and unrealistic for most. Identify those areas most in need of secure data sharing and deploy a solution here first. Then you can expand your policy-driven authorization solution.
Don’t take shortcuts: PBAC is not a silver bullet. You can’t write a policy without identifying the attributes that will be used to enforce authorization. Map your authorization requirements thoroughly according to regulations and data-sharing requirements.
Externalize PBAC: Keep policies in an externalized server, such as the Axiomatics Policy Server, rather than directly in an application. This will enable policies to be applied organization-wide, in databases and data lakes, application programming interfaces (APIs), and microservices, basically wherever they are required.
Utilize automated reporting: Regulations change, business policies change, and so do authorization needs. When authorization policies are edited you want reports to be automatically generated, otherwise you will lose control of who has access to what. An automated reporting tool can also provide data on who is accessing or has access to which data and under what conditions, should a policy rewrite be required.

Axiomatics and PBAC

No matter where your critical assets are stored or how complex or distributed your architecture is, we can help you safeguard and securely share them. Our team has experts in defining requirements and tailoring our ABAC solution to meet your policy-driven authorization needs.

FAQ

Can PBAC work with RBAC?

Yes. PBAC can incorporate existing RBAC models by using roles as one of many inputs into policy decisions. Organizations often use roles to define baseline permissions while PBAC policies evaluate additional factors such as resource sensitivity, location, device posture, or time of access. This allows businesses to extend existing RBAC investments with fine-grained, context-aware authorization.

Is PBAC scalable?

Yes. PBAC is designed to scale across large enterprises, cloud environments, APIs, and distributed applications. Because policies are centralized and reusable, organizations can apply consistent authorization rules across thousands of users, applications, services, and resources without duplicating authorization logic.

Does PBAC support least privilege?

Yes. PBAC enables organizations to enforce the principle of least privilege by evaluating every access request against centralized policies. Instead of granting broad, static permissions, PBAC authorizes only the specific actions required under the current context, reducing over-permissioning and limiting security risk.

How is PBAC implemented?

PBAC is implemented through a combination of components that work together to enforce dynamic, context-aware access decisions. At the heart of PBAC is the Policy Decision Point (PDP), which evaluates access requests against a set of defined policies to determine whether access should be allowed or denied. The Policy Enforcement Point (PEP) acts on the PDP’s decision, granting or blocking access to the requested resource. Policies themselves are created and managed through a Policy Administration Point (PAP), which allows administrators to define rules based on attributes of the user, resource, action, and environmental context. Many implementations leverage standards like XACML or cloud-native policy engines, enabling fine-grained, flexible, and auditable access control without requiring hardcoded permissions in applications.

How do PBAC policies differ from hardcoded permissions?

PBAC policies differ from hardcoded permissions in that they are centralized, and dynamic, rather than being fixed directly in the application code. Hardcoded permissions require developers to manually assign access rights in the program, making updates slow, error-prone, and difficult to scale. In contrast, PBAC policies are externalized and managed separately, allowing administrators to define, update, or revoke access rules without changing the underlying code. This approach also makes auditing and compliance easier because all access rules are documented and centrally controlled.

See how Axiomatics enables Zero Trust.

Request a Demo

Follow us for more insights

Watch our webinars

Watch now

Company Updates

From AI to Authorization: Key Takeaways from Identiverse 2026

7 min read

Attribute-based Access Control

The Challenge Isn’t AI. The Challenge Is Authorization.