--- title: Moving Beyond RBAC with Compliant Access Delivery description: The evolution of access control has prompted the need for a more dynamic approach than traditional RBAC. Compliant Access Delivery offers a comprehensive solution by combining RBAC, ABAC, and PBAC strengths. image: https://blog.empowerid.com/hubfs/image-png-Aug-21-2023-12-45-17-6419-PM.png --- [![empowerID-logo](https://blog.empowerid.com/hubfs/empowerID-logo.svg "empowerID-logo")](http://www.empowerid.com) **![phone](https://blog.empowerid.com/hubfs/images/phone.svg)   1-877-996-4276   **or**  +1 (614) 652-6825** [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/220903377569) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/company/85780) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/EmpowerID) [![Share on pinterest](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/pinterest-color.png?width=24&name=pinterest-color.png) ](http://www.youtube.com/user/empowerID) # All-In-One Identity Management and Cloud Security Emerging technologies are challenging old paradigms and unveiling new ways of approaching the security discipline that enables the right individuals to access the right resources at the right times for the right reasons. EmpowerID has embedded innovative technologies in every aspect, providing flexible and mature IAM capabilities in the cloud, on premise and in hybrid environments, addressing the mission-critical need across increasingly heterogeneous technology environments, and meeting increasingly rigorous compliance requirements. # Moving Beyond RBAC with Compliant Access Delivery Posted by [Aditya Taneja](https://blog.empowerid.com/blog-1/author/aditya-taneja) on Tue, Aug 29, 2023 ![Aditya Taneja](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) - [Tweet](https://twitter.com/share) In our previous article, we covered the benefits and drawbacks of different authorization models, namely: - **Role-Based Access Control (RBAC)** - **Attribute-Based Access Control (ABAC)** - **Policy-Based Access Control (PBAC)** We summarized that each of them had its unique characteristics. However, for organizations aiming to scale and manage thousands of users, no single method covers all use cases and application technologies. This is because certain types of applications and use cases are better suited for a structured role-based approach, while others require real-time contextual decisions. While there are overlapping qualities among these models, individually, none of them can address all the necessary aspects of access control. To meet the needs of these organizations, a combination of the benefits from all these authorization models is required to fully ensure the security requirements of enterprises from every possible angle. This is where the need for a hybrid authorization model arises. With all these considerations, we at EmpowerID embarked on a journey to create a perfect authorization recipe – one that encompassed all aspects of authorization without the drawbacks associated with each model. The result of this endeavor is a unique hybrid approach that combines role and attribute compliance, which we aptly named *"Compliant Access Delivery."* The overall goal of Compliant Access Delivery required using the best of each approach implemented following the principles of *Zero Trust* and *Least Privilege*. Based on RBAC relational modeling, it provides the backbone or structure for defining an organization and its overall policies while leveraging the flexibility and real-time contextual nature of ABAC and PBAC to offer the most comprehensive access control solution.  ## Compliant Access Delivery “Compliant Access Delivery” is, first, the capability to map out in advance the position appropriate access for employees, partners, and customers and the risk policies that will measure and ensure continued compliance and to then monitor and enforce this compliant state through automation. ![MicrosoftTeams-image (29)](https://blog.empowerid.com/hs-fs/hubfs/MicrosoftTeams-image%20(29).png?width=734&height=317&name=MicrosoftTeams-image%20(29).png)   The natural follow-up question to this is *“What makes access compliant?”* Compliant access is appropriate to the person to whom it is assigned in accordance with the organizational standards and business policies to minimize risk. Compliant Access Delivery synthesizes multiple Identity and Access Management (IAM) technologies with a business modeling approach to automate and maintain each user's appropriate access to IT systems while continuously minimizing risk.  ![Splitter Copy 2](https://blog.empowerid.com/hs-fs/hubfs/Splitter%20Copy%202.png?width=734&height=3&name=Splitter%20Copy%202.png) *Compliant Access is a well-defined target state against which the current state can be* *measured.* ![Splitter Copy 2](https://blog.empowerid.com/hs-fs/hubfs/Splitter%20Copy%202.png?width=734&height=3&name=Splitter%20Copy%202.png) The key to Compliant Access are the words *“appropriate”* and compliant with *“business policies.”* With Compliant Access, the devil is in the details, and that is where traditional solutions miss the mark. Due to its distinct language, processes, and policies, Compliant Access cannot be delivered by an IAM system that doesn't bridge the divide between the technical system and the business. With its operating procedures, industry norms, and regulatory restrictions, the business defines *which jobs are appropriate, what constitutes a risk, and what is considered non-compliant.* To achieve this, EmpowerID leverages both the organization’s business model and its language to enforce and provision Compliant Access across Cloud and on-premises systems. How Does Compliant Access Leverage Your Business Model?  Defining business-appropriate access is a challenge for IT organizations using their existing IAM systems. These systems were designed to manage only the technical aspects of access control and universally lack a conceptual *“bridge”* to tie the technical entitlements to the business’s operating model and the activities or *“Functions” *performed by its participants.  Everything we cover in this blog can be explored further in our whitepaper “A Guide to Authorization”. You can find that whitepaper here:  **** ** [![FREE WHITEPAPER A Guide to Authorization Discover the ultimate guide to authorization and how applications make decisions in our 60-page white paper.  ](https://no-cache.hubspot.com/cta/default/174819/interactive-131064698192.png) ](https://blog.empowerid.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIZw5JxMj1xFYUl0o0sWE7HrgnCJqtQvGIwTmxwduwLdJk7TUh9sSVZaL8nIDn1sfha6Efo1WJ1%2F2WUaHvt3BUze%2FvrRlozt9dRulZKCNJ1CjWoArpEeNUrO5FtQXC0pGFM0ncsQPcphZ4Hu76iar%2BUNkPnyBC9sW77aNA6tR7FKHMcXoZLDKK90qmYJZwVaPS%2BbqOQ%2BA%3D%3D&webInteractiveContentId=131064698192&portalId=174819) ** ** ** **Business Processes and Functions** Businesses are composed of processes for producing and delivering goods or services. These processes involve tasks performed by internal and external participants. Each task can be divided into functions needed for its completion. For instance, creating a purchase order is a function within a purchasing process. While a purchase order is recognizable and its creation straightforward, not all employees should have this ability. During access reviews, managers can easily identify authorized users. This simplicity contrasts with technical entitlements that grant system access, often named confusingly. Functions bridge the gap between technical access and business understanding, ensuring a clear separation between business and IT. **Risk Policies** Compliant Access must be "appropriate" and align with an organization's "business policies." These policies are specific to the organization and cater to its operations, industry, processes, and regulations. Notably, these policies are distinct from the organization's IT systems. For example, the customer acquisition process's risks remain consistent across different Customer Relationship Managers (CRMs) like SalesForce.com or HubSpot. Users' end-to-end functions can be defined before any IT system interaction. Identifying higher-risk functions and potential fraud combinations empowers threat mitigation. Crucially, establishing risk policies at the function level ensures core business activities are monitored effectively. Business users often face confusion when risk policies are tied to technical entitlements instead of familiar business concepts, hindering visibility into actual actions. Bridging the Gap between Business and Technology ![](https://blog.empowerid.com/hubfs/image-png-Aug-28-2023-11-44-58-4160-AM.png) To align business-appropriate access and risk policies, focusing on functions is crucial. This requires bridging them to IT systems, where business specialists play a key role. They map out business processes, activities, and roles involved (Figure 41). Collaborating with IT experts, they convert functions into task-based application roles within specific systems (Figure 42). EmpowerID supports mapping roles to functions and even mapping fine-grained permissions to functions. This clarifies which IT entitlements enable functions, who can perform them, and how access is assigned. Functions enhance business clarity in your IT landscape. ![Splitter Copy 2](https://blog.empowerid.com/hs-fs/hubfs/Splitter%20Copy%202.png?width=734&height=3&name=Splitter%20Copy%202.png)  Sign up for our Newsletter! ![Splitter Copy 2](https://blog.empowerid.com/hs-fs/hubfs/Splitter%20Copy%202.png?width=734&height=3&name=Splitter%20Copy%202.png) **Conclusion**   In conclusion, the evolution of access control has led us to recognize the limitations of traditional models like RBAC. The new era demands a dynamic approach that bridges the gap between technical intricacies and real-world business needs. Compliant Access Delivery emerges as the answer, offering a comprehensive solution that combines the strengths of RBAC, ABAC, and PBAC.    This hybrid approach ensures that access remains not just efficient, but also "appropriate" and aligned with an organization's specific "business policies." It leverages the expertise of both business and IT specialists to map out functions and roles, transforming them into practical, task-based application roles within IT systems.    By embracing Compliant Access Delivery, organizations can confidently manage thousands of users, diverse application technologies, and industry-specific regulations. The complexity of modern enterprises is tamed through a holistic framework that leverages the power of functions – the essential building blocks of business processes. With this innovative approach, organizations can strike the balance between stringent security and operational efficiency, ensuring that access is not only controlled but also relevant and compliant.   ### Learn How CAD can evolve your Authorization Model Tags: [Active Directory](https://blog.empowerid.com/blog-1/topic/active-directory), [IAM](https://blog.empowerid.com/blog-1/topic/iam), [Virtual Directory](https://blog.empowerid.com/blog-1/topic/virtual-directory), [Access Governance](https://blog.empowerid.com/blog-1/topic/access-governance), [cloud security](https://blog.empowerid.com/blog-1/topic/cloud-security) ### About EmpowerID EmpowerID is the all-in-one Identity Management and Cloud Security platform designed for people.  Globally managing millions of identities in diverse enterprises, EmpowerID offers comprehensive provisioning, single sign-on and access governance coupled with an industry leading user experience.  Built on a single codebase for manageability and scalability, EmpowerID ships with a powerful API, a visual workflow designer and over 400 ready-to-use workflows for rapid deployment.   [![Free Evaluation of EmpowerID](https://no-cache.hubspot.com/cta/default/174819/daebe087-5275-487d-bf53-bb1d39fb9dc4.png)](https://cta-redirect.hubspot.com/cta/redirect/174819/daebe087-5275-487d-bf53-bb1d39fb9dc4) ### Latest Posts ### Posts by category - [2-Factor (2)](https://blog.empowerid.com/blog-1/topic/2-factor) - [Access Governance (36)](https://blog.empowerid.com/blog-1/topic/access-governance) - [Active Directory (46)](https://blog.empowerid.com/blog-1/topic/active-directory) - [Attestation (4)](https://blog.empowerid.com/blog-1/topic/attestation) - [authentication (6)](https://blog.empowerid.com/blog-1/topic/authentication) - [authorization (2)](https://blog.empowerid.com/blog-1/topic/authorization) - [azure (1)](https://blog.empowerid.com/blog-1/topic/azure) - [Azure security (2)](https://blog.empowerid.com/blog-1/topic/azure-security) - [azuread (1)](https://blog.empowerid.com/blog-1/topic/azuread) - [Cisco (1)](https://blog.empowerid.com/blog-1/topic/cisco) - [Citrix (1)](https://blog.empowerid.com/blog-1/topic/citrix) - [cloud (1)](https://blog.empowerid.com/blog-1/topic/cloud) - [cloud security (28)](https://blog.empowerid.com/blog-1/topic/cloud-security) - [consumers (2)](https://blog.empowerid.com/blog-1/topic/consumers) - [Data Governance (5)](https://blog.empowerid.com/blog-1/topic/data-governance) - [dataprivacy (1)](https://blog.empowerid.com/blog-1/topic/dataprivacy) - [DirSync (1)](https://blog.empowerid.com/blog-1/topic/dirsync) - [eic (1)](https://blog.empowerid.com/blog-1/topic/eic) - [Federation (6)](https://blog.empowerid.com/blog-1/topic/federation) - [Gartner (1)](https://blog.empowerid.com/blog-1/topic/gartner) - [GDPR (2)](https://blog.empowerid.com/blog-1/topic/gdpr) - [Governance and Regulatory Compliance (4)](https://blog.empowerid.com/blog-1/topic/governance-and-regulatory-compliance) - [GRC (3)](https://blog.empowerid.com/blog-1/topic/grc) - [Group Management (12)](https://blog.empowerid.com/blog-1/topic/group-management) - [IAG (4)](https://blog.empowerid.com/blog-1/topic/iag) - [IAM (34)](https://blog.empowerid.com/blog-1/topic/iam) - [IDaaS (1)](https://blog.empowerid.com/blog-1/topic/idaas) - [Identity and Access Management (IAM) (68)](https://blog.empowerid.com/blog-1/topic/identity-and-access-management-iam) - [Identity Management (6)](https://blog.empowerid.com/blog-1/topic/identity-management) - [iga (1)](https://blog.empowerid.com/blog-1/topic/iga) - [M365 security (1)](https://blog.empowerid.com/blog-1/topic/m365-security) - [Magic Quadrant (1)](https://blog.empowerid.com/blog-1/topic/magic-quadrant) - [O365 (1)](https://blog.empowerid.com/blog-1/topic/o365) - [Office 365 (3)](https://blog.empowerid.com/blog-1/topic/office-365) - [open policy agent (1)](https://blog.empowerid.com/blog-1/topic/open-policy-agent) - [Palo Alto (1)](https://blog.empowerid.com/blog-1/topic/palo-alto) - [Password management (13)](https://blog.empowerid.com/blog-1/topic/password-management) - [Privacy and EU-US Data Transfers (1)](https://blog.empowerid.com/blog-1/topic/privacy-and-eu-us-data-transfers) - [Privacy Shield (1)](https://blog.empowerid.com/blog-1/topic/privacy-shield) - [Radius (1)](https://blog.empowerid.com/blog-1/topic/radius) - [RBAC (2)](https://blog.empowerid.com/blog-1/topic/rbac) - [Role Based Access Control (RBAC) (40)](https://blog.empowerid.com/blog-1/topic/role-based-access-control-rbac) - [SAML (4)](https://blog.empowerid.com/blog-1/topic/saml) - [Separation of Duties (2)](https://blog.empowerid.com/blog-1/topic/separation-of-duties) - [SharePoint (8)](https://blog.empowerid.com/blog-1/topic/sharepoint) - [siemens (1)](https://blog.empowerid.com/blog-1/topic/siemens) - [Single Sign-on (1)](https://blog.empowerid.com/blog-1/topic/single-sign-on) - [Single Sign-on (SSO) (26)](https://blog.empowerid.com/blog-1/topic/single-sign-on-sso) - [social media (1)](https://blog.empowerid.com/blog-1/topic/social-media) - [SSO (3)](https://blog.empowerid.com/blog-1/topic/sso) - [User provisioning (28)](https://blog.empowerid.com/blog-1/topic/user-provisioning) - [VDS (1)](https://blog.empowerid.com/blog-1/topic/vds) - [Virtual Directory (28)](https://blog.empowerid.com/blog-1/topic/virtual-directory) - [WS-Fed (2)](https://blog.empowerid.com/blog-1/topic/ws-fed) ### Subscribe via E-mail Share This Page [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fmoving-beyond-rbac-with-compliant-access-delivery%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fmoving-beyond-rbac-with-compliant-access-delivery%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fmoving-beyond-rbac-with-compliant-access-delivery%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fmoving-beyond-rbac-with-compliant-access-delivery%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png) ](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fmoving-beyond-rbac-with-compliant-access-delivery%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.empowerid.com%2Fblog-1%2Fmoving-beyond-rbac-with-compliant-access-delivery%3Futm_medium%3Dsocial%26utm_source%3Demail) ![](https://blog.empowerid.com/hubfs/images/logo-empowerid.svg) 4393 Tuller Road Dublin OH EmpowerID is a registered trademark and trade name of The Dot Net Factory, LLC. EmpowerID © 2021 EmpowerID ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Aditya Taneja", "url" : "https://blog.empowerid.com/blog-1/author/aditya-taneja" }, "dateModified" : "2023-09-26T14:10:05.456Z", "datePublished" : "2023-08-29T09:43:13.000Z", "headline" : "Moving Beyond RBAC with Compliant Access Delivery", "image" : [ "https://blog.empowerid.com/hubfs/image-png-Aug-21-2023-12-45-17-6419-PM.png" ], "mainEntityOfPage" : { "@id" : "https://blog.empowerid.com/blog-1/moving-beyond-rbac-with-compliant-access-delivery", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.empowerid.com/hubfs/Asset%201.svg" }, "name" : "EmpowerID" } } ```