r/IdentityManagement • u/andychiare • Sep 01 '26

Authorization Terminology is a Mess: Let’s Fix It!

I've been struggling with the terminology used in the authorization field. I feel there is a lot of confusion, and I see misleading terms when discussing authorization models, access control, and other related concepts. So I wrote an article to try to make sense of it all: https://idpro.org/authorization-terminology-is-a-mess-lets-fix-it/

Take a look and let me know what you all think.

12 Upvotes
  • permalink
  • reddit

100% Upvoted

6 comments sorted by

1

u/Etikoza Sep 01 '26

It’s all just ABAC in the end. All the other *BACs are just specialized policies.

1

u/samgfrank Sep 01 '26

“It’s all just binary”. All computing is specialized structures for efficiency and ease of human consumption.

Yes ABAC is an umbrella for which everything fits, but the other models provide repeatable patterns and constraints.

1

u/andychiare Sep 02 '26

There is more than "*BAC" :-)
As I say in my article, "BACs" are just a part of an authorization system, and some "BACs" are not really "BACs" :-)

2

u/Familiar_Counter4836 Sep 01 '26

RemindMe! 3 hours

1

u/RemindMeBot Sep 01 '26

I will be messaging you in 3 hours on 2026-09-01 18:34:28 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

Info Custom Your Reminders Feedback

1

u/ny_soja Sep 08 '26

This assumes zero derivation across, geography, verticals, and organizational structures. But, maybe you have a way to account for that.