Data Access Model
The scheme by which permission to data is granted, whether by role, by attribute, by purpose, or by request with expiry.
The model chosen determines whether access management scales or becomes a permanent operational burden, and most organisations discover the limits of their choice only after it has become deeply embedded.
Role-based access is the default and works until roles multiply. Each new combination of domain, region and sensitivity spawns another role, and estates routinely end up with more roles than people, at which point nobody can say what any of them grant.
Attribute-based access evaluates a policy against attributes of the user, the resource and the context — a user in this region with this clearance may read data tagged for that region during business hours. It scales far better because policies are general rather than enumerated, and it requires trustworthy attributes on both users and data, which is the real prerequisite and where most implementations stall.
Purpose-based access adds the dimension that data protection law actually asks about: not who you are but why you are accessing it, with the purpose recorded and constrained.
Just-in-time access grants elevated permission on request for a bounded period with automatic expiry, which is the strongest control for sensitive data because it removes standing access — the thing that turns one compromised account into a full extraction.
The governing metric for any of these: what proportion of granted access is actually used? In most estates it is low, and the unused remainder is pure risk.