Mobile health inspectors need access to case records only when their clearance is sufficient, they are within an assigned district geofence, and the request occurs during their shift. Which model best expresses that decision?

Attribute-based access control (ABAC) decides each request by evaluating attributes of the subject (clearance, role, inspector ID), the object (case sensitivity, record type), and the environment (geofence, shift clock, device posture) against policy. Mobile health inspectors who may open case records only when clearance is sufficient, they are inside an assigned district, and the request falls within shift hours need that multi-dimensional evaluation in one decision. ABAC (or a policy language that behaves like it) expresses those conjunctions without forcing a single static ACL or a lone classification stamp to carry the whole burden.

Discretionary control based only on who created the case file fails because ownership does not encode clearance, district, or shift; creators could over-share sensitive health cases. Single-label MAC that ignores location and time may enforce classification but cannot express the geofence and schedule constraints the city required for field work. Password-length policy is an authenticator-strength control, not an authorization model; longer secrets do not decide whether this inspector, at this GPS point, at this hour, may read that case.

Exam caveat: stems that combine subject, object, and environmental factors in one permit decision are signaling ABAC (or policy-based access with rich attributes), even if RBAC roles exist underneath as attribute sources. Operational check: confirm the policy engine receives fresh clearance, geolocation, and shift attributes; test deny paths when the inspector leaves the district or works off-shift; and ensure offline or GPS-spoof edge cases have documented compensating controls for public-health continuity.