A model that controls access based on attributes. If a user does not possess the attributes required to perform an action, the available functionality is restricted.

(Example: The features available differ depending on whether access is from an in-office PC or an external smartphone.)