Policy Authoring

Object-Based Access Control implements user authorization by using permissions to define what each user can do to the objects the user has access too.

The primary way policy-based access management differs from role-based is in regard to how access permissions are determined. Role-based access is determined based on static user roles, such as “analyst,” “compliance officer,” etc. Policy-based access is determined not just on roles, but on policies that can be built on more dynamic factors like attributes and contextual purposes. This can increase the specificity and scalability of access determinations without risking security and efficiency.

Policy-based access controls combine user roles and/or attributes with written policies in order to determine individual access permissions. For example, an organization could create the following data access policy: “Allow users to subscribe when user possesses attribute Department with value Finance On data sources with columns tagged Discovered>Entity>Credit Card Number.” This policy would determine whether or not users at this organization could access credit card number data based on whether or not they are part of the finance department.

Policy-as-code tools are used to ensure that comprehensive data policies are translated and enforced in the appropriate platform-specific code for each part of your data ecosystem. Each individual data platform can have its own syntax, technology, or platform-specific implementations, so policy-as-code tools work to operationalize policies regardless of these specificities.