At a hospital, two clinicians share one role, yet only the clinician who is on the hospital network and also holds a privileged attribute may export records. Why is role-based access alone the wrong description of this rule?
Select an answer to reveal the explanation.
Short Explanation
Sharing a job title is like sharing a uniform, and the door still checks extra stamps. You need those extra attributes, network location and a privilege mark, before the export opens. The trap is stopping at the shared role, or calling the rule a clock or a log.
Full Explanation
Role-based access would treat two people in the same role the same way. This hospital rule also requires the clinician to be on the hospital network and to hold a privileged attribute, so the decision uses attributes of the subject and the environment in addition to the role. That makes the rule "Attribute-based access, using network location and a privilege attribute beyond the shared role". "Discretionary access, on the view that clinicians may choose to share their own records with each other" would let an owner grant access by choice, and nothing here says a clinician is picking who may export. "A time-based lock that opens record export only during a published clinical shift window" would depend on the clock, and the scenario never mentions a shift or a time window. "An accounting report that lists exports after they happen and does not decide who may export" is a record written after access, not the rule that allows the export. Exam caveat: a role can be one attribute inside an attribute-based policy, and the presence of a role name does not make the whole rule role-based when location and privilege are also required. Operational check: review the export policy and confirm it evaluates network location and the privilege attribute, then test with two accounts in the same role where only one attribute set matches.