Attribute-Based Access Control (ABAC) Overview

As part of ABAC Phase 1: Foundations, Attribute-Based Access Control (ABAC) is an access-control model that brings record-level access management to the OneTrust Platform. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses sharing, attributes, and workflows through assignments to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access.

For example, a user may be able to:

• Access only records they own.

• Access records where they are designated as an approver.

• Access records that have been explicitly shared with them.

ABAC helps ensure users can access the records relevant to their responsibilities. By providing more precise control over record-level access, organizations can improve governance, reduce administrative complexity, and scale access management more effectively.

As organizations grow, access requirements become more complex and difficult to manage through roles alone. Different users may require different levels of access to the same record based on their responsibilities, and those requirements can change over time. While role-based access controls provide broad, consistent permissions, organizations often need a more flexible and scalable approach to support collaboration, governance, and security requirements across teams and workflows.

ABAC helps organizations implement a least-privileged access model by aligning access with ownership, approvals, reviews, sharing relationships, and other record-specific responsibilities. This enables organizations to provide targeted access to records, reduce over-permissioned access, support cross-functional collaboration, and maintain consistent governance as users, records, and business processes scale.

Key Benefits with ABAC Phase 1: Foundations

• Provides more granular, record-level access control.

• Supports least-privileged access across teams and workflows.

• Reduces the need and maintenance of highly customized roles.

• Improves governance and accountability for access decisions.

• Enables the business to move faster through enhanced collaboration while maintaining appropriate access controls.

• Scales access management more effectively by reducing administrative oversight and access-related bottlenecks as users, records, and business processes grow.

The following concepts form the foundation of how ABAC works and are used throughout ABAC documentation, configuration experiences, and access-control workflows.

ABAC helps organizations implement least-privileged access by evaluating the relationships between users and records. Access may be granted based on record ownership, assignments, attributes, workflow participation, or explicit sharing. Rather than providing broad access to all records within a solution, ABAC evaluates these relationships to determine whether a user should have access to a specific record and what actions they can perform on it. By evaluating access at the record level, ABAC helps ensure users receive access only to the records necessary to perform their responsibilities.

ABAC is designed to work alongside OneTrust's existing Role-Based Access Controls (RBAC) model. Roles will continue to provide broad access and privileges through static role-based permissions, while ABAC adds more granular control over which records users can access and what permissions they have on those records. Together, roles and ABAC help organizations grant users the access they need while limiting access to records that are not relevant to their responsibilities, helping organizations implement a least-privileged access strategy within OneTrust.

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of the OneTrust 202608.1.0 Summer Seasonal Release (August 2026). Additional capabilities will be introduced over time through Phase 2: Dynamic Access, which expands automation and scalability for access management.

ABAC Phase 1: Foundations (Public Preview)

ABAC Phase 1: Foundations introduces the foundational capabilities required to manage record-level access and collaboration. The following capabilities included in Public Preview establish the foundation for more advanced access-control scenarios in future ABAC releases.

Capability	Description
Direct sharing	Share individual records directly with users, including users across organizations, without requiring administrator intervention.
Request access	Allow users to request access to records, with owners able to approve or deny requests.
Assignments	Define the actions users can perform on a record, such as viewing, editing, deleting, reassigning, or sharing.
Manage access	View all users who currently have access to a record and update or revoke access when needed.
Record-level auditing	Track access-related activities such as sharing, access updates, and access revocations.

Note:

In ABAC Phase 1, support will initially be available for a subset of objects and functionality. Additional capabilities and object support will be introduced in future releases. For more information, see Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC).

ABAC Phase 2: Dynamic Access (Future Release)

ABAC Phase 2: Dynamic Access expands upon the foundational capabilities introduced in ABAC Phase 1: Foundations by introducing more automated and scalable access-control experiences. Dynamic Access capabilities are designed to further automate ABAC while reducing administrative overhead as organizations scale.

Capability	Description
Criteria-based access rules	Automatically grant access when defined attributes or conditions are met. For example, permissions can be automatically assigned to a user identified as the owner of a record.
Field-level permissions	Control view and edit access for individual fields within a record.
Bulk sharing	Share access across multiple records simultaneously to support high-volume operational environments.
Access expiration	Define time-based access with automatic expiration and revocation.
Elevated access requests	Allow users to request additional privileges for specific records, subject to approval.
Restricted user selection lists	Control which users appear in assignment and sharing experiences based on user type, attributes, or other criteria.

Recommended Next Article

➡️ Understanding Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)

Understand the differences between RBAC and ABAC, how broad role-based access compares to granular record-level access, and how the two models work together to support a least-privileged access strategy.

ABAC Learning Path

1. Attribute-Based Access Control (ABAC) Overview ✅

2. Understanding Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)

3. Using the Basic Role for Attribute-Based Access Control (ABAC)

4. Before Enabling Attribute-Based Access Control (ABAC) in Your Tenant

5. Supported Objects, Exclusions & Timelines for Attribute-Based Access Control (ABAC)

6. Assessment Considerations for Attribute-Based Access Control (ABAC)

7. Reporting Considerations for Attribute-Based Access Control (ABAC)

8. Attribute-Based Access Control (ABAC) FAQ

9. Implementation Playbooks: Attribute-Based Access Control (ABAC)