A municipal ERP portal must allow finance staff access only during published business hours and only from city office subnets. Which authorization approach best matches that design?

Rule-based access control evaluates predefined conditions—time windows, source networks, protocols, or similar environmental predicates—before a permit or deny is returned. Requiring municipal ERP access only during published business hours and only from city office subnets is a textbook expression of those rules: even a correctly role-assigned finance clerk is denied when the clock or the client subnet fails the gate. Rules frequently complement RBAC or other models; the distinguishing teaching point is that authorization hinges on explicit conditional policy, not solely on identity or clearance.

Mandatory labels that ignore time and source network miss the environmental constraints the city demanded; clearance matching alone would still allow midnight logons from home broadband if those signals are not evaluated. Pure discretionary sharing where supervisors email VPN passwords after hours abandons centralized policy for ad hoc owner decisions and weak secret distribution, creating accountability and credential-theft risk. Biometric enrollment strengthens identity proofing and authentication, yet it does not encode schedule or subnet authorization conditions by itself—authentication is not a substitute for the rule set that gates the ERP portal.

Exam caveat: when a stem stresses time-of-day, source address, or similar if-then gates, prefer rule-based (or ABAC environmental attributes) over pure MAC/DAC/RBAC narratives. Operational check: verify ERP PDP/PEP configuration enforces both hour and subnet rules in production, confirm exception paths for on-call finance work are ticketed and time-bound, and sample deny logs to prove the rules fire outside business hours or from non-city networks.