Rule-based access control

Rule-based access control applies a single set of rules to every subject who requests access, regardless of identity or job function. The classic examples are firewall access control lists, which allow or deny packets by address and port for all traffic, time-of-day restrictions that lock everyone out of a system overnight, and proxy filters that block categories of website for the whole organisation. An administrator sets the rules and the system enforces them uniformly; individual users get no say and no exceptions.

The trap is the acronym. Rule-based and role-based access control both abbreviate to RBAC, and exam writers exploit that collision deliberately. The test is who the control cares about: a rule applies to all subjects identically (nobody connects after 22:00), while a role applies permissions to a defined job function (payroll clerks can run payment batches). Rule-based control is also non-discretionary, since a central authority writes the rules and object owners cannot override them, a property it shares with mandatory access control.

Exam relevance: if a scenario mentions a firewall ACL, a router filter, or a restriction applied to everyone regardless of identity, the answer is rule-based access control. If the scenario ties access to a job title or department, the answer is role-based. When both appear as options, ask whether the control distinguishes between users at all: rules do not, roles do.