Access control model using attributes (user, resource, environment, action) to determine access. More flexible than RBAC for complex, context-aware policies.