Definition
Attribute-Based Access Control (ABAC) is an authorization model where access decisions are made by evaluating attributes of the user, resource, action, and environment against a policy.
In more depth
ABAC decisions look like: "Allow access if user.department == resource.department AND time.hour BETWEEN 8 AND 18 AND user.clearance >= resource.classification." Policies are written in a policy language (XACML, OPA Rego, Cedar) and evaluated by a Policy Decision Point (PDP) at request time.
ABAC offers fine-grained control but adds complexity. Most modern programs combine RBAC for coarse-grained access (which app you can use) with ABAC for fine-grained authorization within the app.
Want the work, not just the definition?