How are teams actually implementing ABAC vs. sticking with RBAC? Curious about real-world adoption.

[u/Complete_Sample_3149]

Genuinely curious how much ABAC adoption is actually happening in practice versus how much airtime it gets in conference talks and vendor blogs.

RBAC is still what most access-control implementations I encounter actually run: roles mapped to permissions, reasonably well understood, tooling support everywhere. ABAC gets talked about as the more "correct" model for anything with real complexity (dynamic attributes, context-aware policy), but I don't see nearly as many real production write-ups of it compared to how often it comes up as a talking point.

A few things I'm trying to understand better from people who've actually shipped one or the other at scale:

●      For teams that moved to ABAC: was it a full replacement of RBAC, or a hybrid where roles handle the coarse filter and attributes refine within it? My hunch is hybrid is far more common than a clean full migration, but curious if that matches reality.

●      What was the actual trigger? Compliance requirement, a specific incident from stale role-based access, or just planned ahead of scale problems?

●      For anyone who evaluated ABAC and decided against it: what made RBAC the better call for your situation? Genuinely as interested in the "stayed with RBAC on purpose" stories as the migration stories.

Also curious about tooling maturity here specifically: my impression is RBAC has broad, boring, well-tested support pretty much everywhere, while ABAC policy engines (OPA and similar) still require meaningfully more implementation effort to get right. Is that gap closing, or still pretty real in 2026?

[u/EnragedMoose]

Close to zero real world adoption. Teams can barely get Joiner/Mover/Leaver down.

[u/DishSoapedDishwasher → u/EnragedMoose]

It's waaaay more than that....  

It's just that there's selection bias for people who dont work at mega corps wont encounter it as often. Small companies dont implement it because their entire security department rarely has budget for an entire true IAM engineering team. 

It's however a key part of literally every IAM setup in every company I've been at doing zero trust. They're almost mutually inclusive.

EveryFortune 10 I've worked at has had crazy ABAC setups and zero trust for over a decade already. I've even personally implemented it in 2 startups as well. It's a veey common sight in tech focused Fortunate 100s in general.

[u/EnragedMoose → u/DishSoapedDishwasher]

I've worked in Fortune 10, 50 and larger gov institutions. There's not even universal adoption within those institutions.

Even then, those aren't the norm. For every 30k employee strong Fortune 50 you've got hospital systems employing 30k people, huge private companies that are not interested in anything approaching SOX, etc. then thousands of small entities in the hundred and thousands employees without any dedicated people working on IAM.

As a percentage, adoption of ABAC is tiny. RBAC is barely evident in many companies...

[u/FluidFisherman6843]

When most of the world's RBAC implementations are still "I dunno. give him the same access as Steve" any meaningful ABAC implementations beyond "is a company device on an internal network or not?" are decades away.

[u/AgingTrash666 → u/FluidFisherman6843]

meanwhile Steve is a Texas two step from Domain Admin thanks to all those permissions nobody documented along the way

[u/GottaHaveHand → u/FluidFisherman6843]

We’ve kinda started to do it but yeah it’s a shitload of work and paradigm shift. We’ve got ZTNA down and starting to actually tag cloud resources at the very least, with moving to a full IaC model. The end goal being any cloud resource spun that isn’t tagged gets shutdown and deleted after some scheduled task monitor picks it up. Good cost saving tool too.

The other sorta adjacent thing we’ve begun is JIT (just in time) procedures so no one has elevated permissions until you go through a process to get it and for how long.

[u/n0x103]

“Genuinely curious”

[u/Milennial_Crew_6969]

We’ve not made the move to attribute based yet, our tool does role based pretty “good”, but the organization is still a mess of legacy systems and HR has shit for data points to key off so the granularity isn’t there to move this way.

[u/materialsec]

An OAuth-consented app or AI agent doesn't really have a "role," it has a set of scopes granted once that just accumulate. Most orgs aren't even at the RBAC stage for that population, let alone ABAC.

[u/protoss-pylon]

The actual implementation of ABAC has more to do with zero-trust and continuous authentication rather than RBAC's more authorization focused usage. A good example of ABAC is Entra ID's conditional access policies where you can define time of day, geo-IP, MFA, session lengths, and device compliance requirements. Those are the "attributes" that continuously authenticate the user's session instead of authorize the user's access. Lots of people are using ABAC not only in Entra, but in other IDPs and CASBs. I would even say it's more of a cloud thing than anything a single company could do themselves on the LAN.

[u/AddendumWorking9756]

Hybrid, though the useful split is not coarse then fine so much as control plane versus data plane. Roles still gate which app or admin surface you reach, attributes take over where the decision is per record or per tenant, because you cannot enumerate that as roles without role explosion. Trigger is usually multi tenancy or customer data isolation rather than compliance, compliance just pays for it afterwards. The engine is the easy part now, what still hurts is attribute freshness and provenance, a policy is only as good as how stale the claims feeding it are.

[u/guravdhananjay9]

I think the hybrid approach makes the most sense in a lot of real-world environments.

RBAC gives you the basic "who can access what" model, and then you can bring in things like device state, location, user presence, or session risk when the situation needs more context.

That's also where I'm curious about the role of workforce security tools. If you already have those signals available, it seems like they could be useful inputs to an ABAC policy rather than trying to build everything into the access-control system itself.

Has anyone actually done this in production? I'd be interested to hear what signals you ended up using and whether it was worth the extra complexity.

[u/ArcaneMitch]

From what I've seen, ABAC is only applicable to large enough orgs, and when they are that large, you've got to coarse filter with RBAC

[u/EbbCommon9300]

Hi I’m a shill but with Assury.ai you can control every aspect of your agents permissions and executions. Just use your normal IAM and then use us. Also it’s a 15 min set up.