The most efficient implementation ofAttribute-Based Access Control (ABAC)in Adobe Real-Time CDP relies on the metadata-driven relationship between data labels and user permissions. Unlike traditional security models that only look atwhothe user is, ABAC looks at theattributesof the data itself to determine access.
The process begins byapplying custom labelsto specific XDM schema fields or attributes (Option D). For example, fields containing sensitive contact information can be labeled as "Protected." The admin then creates Access Groupsand definesPoliciesthat link these labels to specific roles. If a user belongs to a group that does not have the "Protected" permission, the system will automatically mask or hide those specific fields across the entire UI, including Profile views and Query Service results.
Option A is inefficient because it leads to "policy sprawl" and is difficult to maintain at scale. Option B is incorrect as AEP is a single, unified data store; you cannot "distribute" data into different databases to manage access. Option C describes a maintenance task for RBAC but does not address the foundational logic of ABAC. By tying labels to access groups, the admin creates a scalable, dynamic security model where access is automatically enforced based on the nature of the data being accessed.