A municipal ERP portal must allow finance staff access only during published business hours and only from city office subnets. Which authorization approach best matches that design?
Select an answer to reveal the explanation.
Short Explanation
Think of a library that unlocks the rare-book room only when the clock says open and you are on the staff Wi-Fi. Those if-time-and-subnet-match gates are rule-based access control—policy rules, not just you-have-the-role.
Full Explanation
Rule-based access control grants or denies based on predefined rules such as time windows, source addresses, or protocol conditions, often implemented alongside other models. Restricting ERP access to business hours and city subnets is a classic rule-based pattern. Clearance-only MAC, owner discretion, or authentication factors alone do not express those environmental conditions.