Users are assigned roles, and roles define what actions are allowed. Access decisions are made based on the user’s role.

Access is determined dynamically based on attributes of the user, the resource, the action, and the environment (context). Very flexible and policy-driven.

Access is determined by the relationship between a user and a resource, not just roles or permissions. Common in social networks and collaborative platforms.

Specifies, for each resource, which users or roles have which permissions. Permissions are tied directly to the resource rather than roles.