> For the complete documentation index, see [llms.txt](https://docs.myveriam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.myveriam.com/for-providers/ciam/policy-based-access.md).
# Policy based access
Policy-Based Access Control (PBAC) is a security framework that governs access to resources based on defined policies. Unlike traditional role-based models, PBAC evaluates contextual attributes, such as user identity, device type, location, and time, to dynamically enforce access decisions. This approach allows for greater flexibility and security, ensuring that access is granted based on real-time conditions rather than static roles.
### Why Use PBAC?
#### 1. Enhanced Security
PBAC enforces strict access policies by considering multiple factors beyond just user roles. By incorporating attributes such as risk levels, device security posture, and contextual information, PBAC reduces unauthorized access and minimizes security threats.
#### 2. Fine-Grained Access Control
Unlike Role-Based Access Control (RBAC), which assigns users predefined roles, PBAC enables organizations to define precise access conditions. Policies can be tailored to specific tasks, ensuring that users only have the necessary permissions based on their current situation.
#### 3. Adaptive and Dynamic Access
PBAC allows organizations to implement real-time access decisions. Policies can dynamically adjust based on changing risk factors, ensuring that access permissions evolve in response to security needs and regulatory requirements.
#### 4. Compliance and Audit Readiness
Regulatory frameworks such as GDPR, HIPAA, and ISO 27001 require stringent access control mechanisms. PBAC facilitates compliance by ensuring that access is granted based on defined policies and monitored in real time. This improves audit readiness and helps organizations meet regulatory obligations.
#### 5. Scalability and Maintainability
Managing access in large organizations with thousands of users can be complex. PBAC simplifies access management by centralizing policies that apply across multiple systems and users. This reduces administrative overhead and makes it easier to update access rules without modifying individual user permissions.
### PBAC on Veriam
Veriam supports PBAC out for the box, fully integrated into the CIAM solution. You don't need any additional external integrations to provide access to your applications or resources based on policyies. You can even combine the flexibility of policy based access with the more traditional role based access.
Because of the flexibility of our policies, our policy based access can also be used to setup Attribute Based Access Control (ABAC) and Resource Based Access Control (RBAC).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.myveriam.com/for-providers/ciam/policy-based-access.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.