Beyond Roles: The Shift to Attribute-Based and Risk-Aware Access Control

The increasing complexity of distributed and cloud-based systems has revealed the limitations of traditional access control mechanisms and highlighted the need for adaptive models capable of operating in dynamic environments. This study analyzes the progression of access control from classical models, such as Discretionary Access Control and Mandatory Access Control, to more recent approaches, including Role-Based Access Control and Attribute-Based Access Control. The primary objective is to evaluate the suitability of these models for contemporary system architectures, including cloud computing and the Internet of Things. While previous research has typically examined these models in isolation, there remains a gap in comprehensive comparisons that address scalability, administrative effort, and adaptability to evolving contexts.

This research employs a systematic comparative analysis using operational, administrative, and security criteria. Each model is assessed based on its capacity to fulfill confidentiality, integrity, and availability requirements under varying conditions. The findings indicate that Discretionary and Mandatory Access Control represent contrasting paradigms, emphasizing either flexibility or control. Role-Based Access Control offers enhanced scalability and administrative simplicity, though it may encounter challenges related to role proliferation. Attribute-Based Access Control enables dynamic, context-aware policies that align with the Zero Trust model and deliver the greatest adaptability in complex environments.

The results confirm that no single access control model is universally applicable. Nevertheless, Attribute-Based Access Control demonstrates the greatest potential for securing modern IoT and cloud ecosystems, provided that robust policy and attribute management mechanisms are in place.