Model

Role explosion

Role-based access stores a sum instead of a product only while access really clusters into a few groups.

roles needed \approx 2^{d} (d independent yes/no dimensions), or i \prod n_{i}

$d$: Dimensions; independent dimensions access depends on (region, department, clearance, purpose)

How it behaves

One input on the horizontal axis, the others held fixed.

Data table

Every number the mechanisms quote for this relationship is recomputed from it, so none of them disagrees with it.

Each mechanism states it in its own names. The general symbol each name stands for is shown with it.

Security & Privacy
How do you protect data from someone who watches your design and then chooses how to attack it?
$2^{d} roles$
Read it in place →