Sep 20, 2026 · Backend Development

Why RBAC Isn't Enough: Building an ABAC Policy Engine with Spring Security

The article explains why RBAC fails for complex resource and context permissions, introduces ABAC with SpEL expressions, shows Spring Security integration via PermissionEvaluator, policy storage using SpEL strings, a deny-first policy engine, real-world scenarios (department orders, document visibility, time-based access), list permissions via SQL filtering, hot reload with Caffeine/Redis, and pitfalls like self-invocation and DB calls in policies.

ABACAttribute-Based Access ControlData Permissions

0 likes · 17 min read

Why RBAC Isn't Enough: Building an ABAC Policy Engine with Spring Security

Open Source Tech Hub

Apr 8, 2021 · Information Security

How to Implement ABAC with PHP‑Casbin for Fine‑Grained Access Control

This guide explains how to use PHP‑Casbin to enforce attribute‑based access control (ABAC) by defining request, policy, and matcher sections, creating attribute‑rich objects, and calling the enforcer to obtain true or false decisions for different subjects and resources.

ABACAccess ControlAttribute-Based Access Control

0 likes · 2 min read

How to Implement ABAC with PHP‑Casbin for Fine‑Grained Access Control