ImplementingAttribute-Based Access Control (ABAC)for granular restrictions like geography and department requires a structured metadata approach. The first essential step is todefine the geographical locations and departments as attributes (Option D)within the XDM schema or as custom labels. In Adobe Experience Platform, ABAC relies on these specific data characteristics to categorize information, allowing the system to distinguish between data belonging to, for example, the "Europe" region versus "North America," or the "Marketing" department versus "Finance".
The second critical step is toincorporate these labels in access policies (Option A). Once the attributes are labeled (e.g., applying a "Region: EU" label to a specific dataset or field), an administrator must create a policy that ties these labels to specific roles. For instance, a policy might state that "Users in the EU Marketing Role" can only view attributes labeled with "Region: EU" and "Dept: Marketing".
Option C is technically incorrect because you do not assignlabelsto roles; you assignpermissions/policiesthat reference those labels to roles. Option B is incorrect because including every attribute in every policy defeats the purpose of granular access control and creates unnecessary system overhead. By defining attributes and linking them via policies to roles, the corporation ensures automated, scalable data segregation that meets regional and organizational security requirements.