ABAC makes decisions based on attributes rather than fixed roles:
Subject attributes: User department, clearance level, location
Resource attributes: Document classification, owner, creation date
Environment attributes: Time of day, IP address, device type
Policy example:
ALLOW if:
subject.department == resource.department AND
subject.clearance >= resource.classification AND
environment.time BETWEEN 9:00 AND 17:00
ABAC handles complex, dynamic rules that RBAC can't express. Trade-off: harder to audit and understand than simple role assignments.