Relationship-based access control (ReBAC) determines access from the relationship between a subject and a resource or between connected entities. Examples include a patient's assigned clinician, a document's project team or a record's case owner.
ReBAC suits collaborative and graph-shaped environments where roles alone are too broad. IGA must govern the sources, ownership and lifecycle of the relationships used in decisions.