title: In Attribute-Based Access Control (ABAC), how to model attributes from a relation between subject and object?
body: <p>In Attribute-Based Access Control (ABAC), what is the recommended way to model attributes that come from <em>a relation between the subject and the object</em>? </p>
  
  <p>Example: medical records as the objects and physicians/nurses' accounts as the subjects. In a simple setting, with no direct relation between subject and object, a rule might state something like "<em>Nurse Practitioners</em> in the <em>Cardiology Department</em> can <em>View</em> the <em>Medical Records</em> of <em>Heart Patients</em>" (example from the <a href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-162.pdf" rel="nofollow noreferrer">NIST Whitepaper</a>). Now imagine that in a database of medical records, every record explicitly references a certain physician's account as its <em>Attending Physician</em>. A rule shall state that only a record's <em>Attending Physician</em> shall be allowed to change some critical property of that record. </p>
  
  <p>How do we best model this in attributes?</p>
  
  <p>Ideally, an authorized subject could carry an attribute "Function = Attending Physician". That would make it easy to express the rule technically, but it would also make the construction of subjects object-specific which sounds wrong.</p>
  
  <p>Alternatively, the object could carry the attribute "Attending Physician = (Account-ID)", which sounds better, but then the technical expression of the rule would be more complicated: "grant access if the subject's Account ID attribute value matches the object's <em>Attending Physician</em> attribute value". (In real life, the relations would probably be more complicated and nested and the rules more difficult to express in simple terms.)</p>
  
  <p>Any recommendations or best practice?</p>
  
  <p>Thanks, John</p>