Technical interview guide

RBAC vs. ABAC Implementation

Assigning permissions via roles versus evaluating policies against attributes — the implementation tradeoffs of each.

Read: 45 min
Practice MCQs: 25
Interview QA: 25
Edition: v5
Editorial status: Reviewed
Relevant for: Identity and Access Management (IAM) Engineer

Scope: NIST RBAC and SP 800-162, NIST SP 800-207, current AWS/Azure/Google IAM, OPA, Cedar, and XACML guidance reviewed 2026-09-04.

Interview QA

Treat each question like a live interview question: answer out loud first (structure, assumptions, tradeoffs), then open the model answer to spot gaps and rehearse a tighter follow-up.

Curated: 2026-10-05 · Written: 2026-10-05 · Reviewed: 2026-10-03

QA-1

Decide between RBAC, ABAC, and a hybrid model.

QA-2

Design an RBAC model for a growing operations platform.

QA-3

Define the authorization request contract.

QA-4

Handle missing, malformed, and stale attributes safely.

QA-5

Design attribute issuance and mutation governance.

QA-6

Specify policy precedence and combining behavior.

QA-7

Prevent IDOR when using a central policy engine.

QA-8

Implement static and dynamic separation of duty.

QA-9

Design and review role inheritance.

QA-10

Build just-in-time privileged access on RBAC and ABAC.

QA-11

Cache authorization decisions without breaking revocation.

QA-12

Design policy-engine availability and failure behavior.

QA-13

How do you optimize PDP evaluation latency and attribute retrieval (PIP) in distributed ABAC architectures?

QA-14

Design a safe policy-as-code delivery pipeline.

QA-15

Design privacy-aware authorization decision logging.

QA-16

Make ABAC access explainable to users and auditors.

QA-17

Use time, network, device, and risk context responsibly.

QA-18

Implement a hybrid authorization rule for a multi-tenant API.

QA-19

Handle joiner, mover, and leaver authorization lifecycle.

QA-20

Design break-glass and exception handling.

QA-21

Secure list, search, export, and bulk mutation endpoints.

QA-22

Carry authorization through asynchronous jobs.

QA-23

Define authorization safety and operability metrics.

QA-24

Evolve authorization schemas and policy data safely.

QA-25