When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset.  I can also see how I could implementing those.i.e. this image gives a clear view of ACL and RBAC for me (as in I can go on and design database tables based on above):(Image courtesy of pressbooks)What I am struggling with is ABAC. Various images I found so far are hand-wavy or overly complicated, or suggest using a 3rd party external entity do Authorization.  Or give weird attribute examples I am not entirely certain how to use.Starting ExampleSo let me start with something in real life.  Say I have a company with 70-200 people.  And my asset to protect is a website with many various pages.  I wish to allow certain people access to certain assets.For example, I want a person Leslie to have access to a web page called Price Manager, and allow her to only manage prices for the Travel price group on that page, but not be able to manage prices for Product group on same page.  How would I implement this using ABAC?Poking around so far, my guess is I could assign Leslie some attributes (but which ones and what are these attributes?) and then have a database table storing those.  I can then design an engine that looks at those attributes (but does not look at Leslie as a Role as is done in RBAC), and decides from there whether or not to grant access to the page.  How would that engine look like? Is it a simple if/else block?  Something else?What happens if Leslie later changes her position and someone needs to change her access?  What will it look like if she needs to have access moved from Product and revoked for Travel?  How will it be coded if she needs to have access revoked to the Price Manager page altogether and hence no longer have access to neither Travel, or Product? The asset in my case, just to restate it, is Price Manager, and a user can access various price groups on that page, such as Travel pricing, Product pricing, etc.What I am looking for is a reasonably complete roadmap towards clarifying the details and towards implementation to where I could go off and implement it without guessing. i.e. it could be completed conceptually and/or have specific example to where I can visualize a database structure, etc.Bonus:  Is ABAC a proper way for a relatively small permission needs i.e. managing 70-200 people & access to some 150 - 450 assets?  Will it be better to stick to ACL/RBAC instead?
What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?
permissions;access control;abac