access-control-rbac

Create Permission and Role classes where roles support wildcard matching and parent-role inheritance, then use a middleware factory like requirePermission(resource, action) that checks the user's assigned roles and returns 403 when access is denied.

RBAC assigns permissions to roles and users to roles, suiting most applications. ABAC evaluates policies against attributes like department, clearance level, or time of day, fitting complex rule sets where context determines access.

Enable @EnableMethodSecurity(prePostEnabled = true) and annotate controller methods with @PreAuthorize using expressions like hasRole('ADMIN') or custom beans such as @accessControlService.canAccessResource for ownership checks.

Yes, the ABACEngine uses a threading lock for add, remove, and update operations, and evaluates against a shallow copy of the policy list so checks do not hold the lock during condition evaluation.

Use relationship-based access control when permissions depend on entity relationships, such as social apps where access flows through friendships or group membership. RBAC fits most applications with stable role definitions.