01 / What each boundary answers
Compare the decision, not the label.
RBAC groups permissions by role; ABAC evaluates attributes of subject, resource, action and environment.
Records how one accountable principal grants a narrower operation to another for a task and period.
02 / Same operating case
Which request must be stopped?
A responder agent delegates log review to a child agent but retains host-isolation permission.
Evaluation exercise
Assign two child agents the same role and resource attributes but different parent grants. The isolation request should be denied to the read-only child.
03 / Architecture fit
How the controls can compose
Use policy attributes to evaluate the request and delegation lineage to establish the child’s ceiling.
These approaches compose; ABAC can represent delegation facts when those facts are trustworthy and lifecycle-managed.
04 / Evidence
Prove the decision and the effect separately.
Role and attributes, parent grant, child grant, narrowing proof, decision and observed host state.
Primary sources