Enterprise authorization is more than roles and permissions.

The standard repository ACL model is not sufficient for the business authorization requirements. Access decisions needed to consider both user attributes and asset or content metadata rather than relying solely on static permissions (https://lnkd.in/gnxwYfmT).

With complex, dynamic group permissions and a large volume of assets or content, relying solely on static permissions or Role Based Access Control (RBAC) becomes difficult to scale and maintain.

Using Adobe Experience Manager (AEM) and Apache Jackrabbit Oak, we designed a hybrid RBAC + Attribute Based Access Control (ABAC) authorization model that evaluated:
User context: Roles, organization, region, and contractual entitlements.
Asset context: Domain, business rules, exclusivity, and folder visibility.

The core principle was simple:
Access = User Eligibility + Asset Eligibility + Business Rules

By integrating a custom PermissionProvider into Oaks security architecture, we established a centralized enforcement point for evaluating these rules instead of scattering authorization logic across application components.

Key takeaway: Complex enterprise authorization requires more than group membership. Combining RBAC and ABAC enables access decisions that reflect real business policies and asset-level restrictions.