RBAC / ABAC Access Lab
Over-access is rarely one dramatic grant — it is a role that is one tier too broad, a second duty that should never sit with the first, an entitlement nobody revoked after a transfer, or a rule that only a context attribute can enforce. Work a queue of access requests and call each one: approve it as least-privilege, or name the finding — an over-privileged role, a separation-of-duties toxic combination, privilege creep from a role change, or a requirement that needs ABAC because it turns on time, location, the resource owner or data classification. You are scored on catch rate against false positives — because blocking a clean grant (an AP clerk with no conflicting duty, a JIT-gated break-glass role) is its own failure. Clear the queue clean.
The real job. More noise, a tighter clock.
Access-review queue
Review each entitlement request: approve if it is least-privilege, or name the finding. Read what the subject already holds and the stated condition.
#1
Priya Nair
condition: Reads the curated sales dataset to build weekly dashboards. No special timing or location.
#2
Marcus Hale
condition: Needs to open and read support cases assigned to his queue.
#3
Dana Okoro
condition: Wants to approve outgoing payments to clear a backlog.
#4
Field Services team (8 technicians)
condition: A tech may view a customer account ONLY while physically on-site at that customer, and ONLY during the booked service window.
#5
svc-nightly-export (service account)
condition: Writes a single CSV to s3://finance-exports each night.
#6
Lena Fischer
condition: Drafts and edits marketing pages; publishing to prod goes through the existing review workflow.
#7
Sam Reyes
condition: Moved from Finance to Marketing 8 months ago; the finance AP role was never removed.
#8
Wei Zhang
condition: Wants to self-approve and deploy his own changes to unblock releases.
#9
Expense-approval workflow
condition: A manager may approve a report only up to a spend limit that scales with their grade band (L5 ≤ $5k, L6 ≤ $25k, Director ≤ $100k).
#10
Rosa Pardo (contractor)
condition: Needs broad cluster access for a one-week migration, then leaves.
#11
Tom Becker
condition: Enters and codes supplier invoices as part of the AP function.
#12
Clinical records access
condition: A physician may open a chart ONLY for a patient on whose care team they are listed (and break-glass for emergencies, fully logged).
Catch rate vs. false positives
Review each grant, then grade. So far 0/12 called, 0/9 risks caught, 0 false positive(s).
How it is scored
Catch rate = risky grants given the exact right finding (over-privileged, SoD, privilege creep, or needs-ABAC).
A false positive (blocking a clean least-privilege grant) takes an extra hygiene bite — an access review that denies legitimate work drives teams to shadow IT.
Harder tiers add subtler grants and deliberate traps (an AP clerk with no conflicting duty, a static role that does not need ABAC, a high-privilege role already gated by JIT/PIM).
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based access-review lab: work a queue of ~18 entitlement requests and call each one — approve as least-privilege, or name the specific IAM finding.
- Findings seeded across the queue: over-privileged roles (Owner/Administrator/*:* when a scoped role suffices), separation-of-duties toxic combinations (vendor-master + payment-approver, author + sole deploy approver, IAM-admin + audit-log-admin), privilege creep (stale entitlements left after a transfer or promotion), and requirements that genuinely need ABAC (time, location, resource owner, data classification).
- You are graded on catch rate weighed against false positives — blocking a clean, least-privilege grant takes an extra hygiene penalty, because an access review that denies legitimate work drives teams to shadow IT.
- Difficulty tiers add subtler grants and deliberate traps: an AP clerk who holds no conflicting duty, a static read-only role that does NOT need ABAC, and a high-privilege break-glass role already gated by just-in-time (PIM) elevation.
- Every grant is static and deterministic, and after grading each one shows why the right call is right — real least-privilege, SoD and RBAC-vs-ABAC reasoning.
Frequently asked questions
What is the RBAC / ABAC Access Lab?
A free, in-browser exercise where you work a queue of access-grant requests — who the subject is, what the job needs, the role or permission being requested, the resource and scope, what the subject already holds, and the stated access condition — and give each one a verdict: approve (least privilege), over-privileged, separation-of-duties violation, privilege creep, or needs-ABAC. You are scored on how many risky grants you catch with the exact right finding versus how many clean, least-privilege grants you wrongly block.
What is the difference between RBAC and ABAC here?
Role-based access control (RBAC) grants permissions through static roles — right when access depends only on the job function and a fixed resource. Attribute-based access control (ABAC) decides each request from attributes of the subject, resource, action and environment — time of day, location, device posture, data classification, or whether the subject is the resource owner / on its care team. The lab teaches when a requirement truly needs ABAC (a per-request condition a role cannot express, where RBAC would force role explosion) versus when reaching for ABAC just adds a policy engine for nothing.
What is a separation-of-duties (SoD) violation?
A toxic combination: one person holding two duties that must be segregated so no single identity can commit and conceal a harmful action. Classic pairs are maintaining the vendor master and approving its payments, authoring code and being the sole approver who can also deploy it to production, and administering identities while also administering the audit logs. The fix is to split the duties across people or add an independent approval step — not simply to shrink the role.
Who is it for?
IAM, platform and security engineers who grant and review entitlements, GRC and audit teams running access recertification, and anyone prepping for a security or cloud interview who wants to feel why project Owner for one bucket, AdministratorAccess on a service account, a maker-who-is-also-checker, a leaver’s un-revoked prod access, or a region-and-time rule crammed into a static role are findings — and why an AP clerk with no conflicting duty or a JIT-gated break-glass role is not.