RBAC grants access through roles that mirror job functions: “Accounts Payable Clerk”, “Store Manager”, “Help Desk L1”. Roles are easy to explain to auditors and managers — if the role catalog stays clean.
ABAC evaluates attributes at decision time: department, location, clearance, device posture, time of day, or resource tags. It shines when the same job title needs different access by context (region, project, customer segment).
RBAC fails when every exception becomes a new role (role explosion). ABAC fails when policies are opaque and nobody can explain why access was granted. Mature programs use a hybrid: RBAC for birthright baselines, ABAC (or policy overlays) for exceptions and risk context — with IGA still owning requests, SoD, certifications, and evidence.
When designing roles, ask: “Would every person in this job need this entitlement every week?” If not, keep it out of the role and route it through a request, time-bound grant, or attribute rule.
Practice below: Build the Role — pick only entitlements that belong in each business role.