Compare RBAC and ABAC for authorization.
Assesses fundamental understanding of Authentication & Authorization conventions, runtime behavior, and memory/performance considerations.
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Role-Based Access Control assigns permissions to roles and roles to users, for example admin can delete any order. It is simple to reason about, easy to audit and a good default for most applications. Its weakness is role explosion and coarse decisions: rules like "editors can edit posts they own in their own department" do not fit cleanly.
Attribute-Based Access Control evaluates policies over attributes of the user, resource, action and environment, for example "allow if user.department == resource.department and time is within business hours". It is fine-grained and expressive, which suits regulated or multi-tenant systems, but policies are harder to write, test and reason about, and can be expensive to evaluate.
RBAC: if (user.roles.includes("editor")) allow
ABAC: if (user.dept === doc.dept && doc.state === "draft") allow
Many systems combine them: roles for coarse access, attributes for per-resource decisions, and relationship checks such as ownership. Evaluate centrally and log decisions for auditability.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.