Purpose-Based Access
Granting access for a stated and recorded purpose rather than by role alone, which is what several data protection regimes actually require.
Role-based access answers "who is this person?". Purpose limitation asks a different question — "why are they using this data, and is that the purpose it was collected for?" — and a role cannot answer it, because the same analyst may legitimately query a dataset for one purpose and not for another.
Purpose-based access binds the grant to a declared reason: this team may query customer transactions for fraud detection, and the same data is not available to them for marketing analysis without a separate basis.
Implementation is usually a purpose declared at query or session time, recorded in the audit log alongside the query, with policy evaluating the combination of identity, purpose and data classification. That audit record is what makes the control demonstrable rather than merely stated — and demonstrability is what a regulator asks for.
The practical failure is a purpose picked from a dropdown that nobody reviews, which produces the appearance of a control and none of the substance. Making it work means a short list of genuine purposes tied to lawful bases, periodic review of what was declared against what was queried, and consequences for misdeclaration.