What is the difference between RBAC and ABAC and when would you use each in NestJS?

Q: What is the difference between RBAC and ABAC and when would you use each in NestJS?

// RBAC — role check (simple, O(1)) return user.roles.includes('admin'); // ABAC — attribute check (expressive, context-aware) return ( user.id === resource.authorId || (user.department === resource.department && user.title === 'Manager') ) && resource.status !== 'archived'; // ABAC with CASL — npm i @casl/ability // Create user ability const ability = abilityFactory.createForUser(user); // Check permissions on a specific resource instance ability.can('update', subject('Article', article)); ability.cannot('delete', subject('Article', article)); // When to use RBAC: // - Admin / user / moderator hierarchies in B2B SaaS // - Simple permission rules that map to job functions // - When performance matters most — no DB lookup needed // When to use ABAC: // - Document ownership: users can only edit their own articles // - Multi-tenant: users can only see their own tenant's data // - Healthcare: doctors can only access patients assigned to them RBAC — simple to implement and reason about; roles are stable and cacheable in the JWT. ABAC — expressive; handles ownership, context, and environment conditions. RBAC limitation: role explosion — too many roles needed to express fine-grained rules. ABAC limitation: complexity; requires careful policy design and often a database lookup per request. CASL is the most popular ABAC library in the NestJS ecosystem — integrates well with TypeORM and Mongoose.

Difficulty: 5/10

authorization, NestJS guards, policy evaluation

RBAC grants access based on the user's role — simple, fast, suitable for job-function-based permissions. ABAC grants access based on attributes of the user, the resource, and the environment — more expressive but more complex. Use RBAC for most B2B SaaS and admin panels; use ABAC for document ownership, multi-tenant apps, and healthcare systems.

RBAC vs ABAC comparison

RBAC vs ABAC trade-offs:

1
RBAC — simple to implement and reason about; roles are stable and cacheable in the JWT.
2
ABAC — expressive; handles ownership, context, and environment conditions.
3
RBAC limitation: role explosion — too many roles needed to express fine-grained rules.
4
ABAC limitation: complexity; requires careful policy design and often a database lookup per request.
5
CASL is the most popular ABAC library in the NestJS ecosystem — integrates well with TypeORM and Mongoose.

Scenario Questions

0-2 years experience

2-5 years experience

1You added an ABAC guard to a NestJS microservice, but some requests are failing with a 403 even though the user has the right attributes. Walk me through how you would debug the issue.

What is the difference between RBAC and ABAC and when would you use each in NestJS?

Scenario Questions

Follow-up Questions