Access control using policies that evaluate multiple conditions and attributes. Enables fine-grained, dynamic authorization decisions based on complex business rules.