A company creates new cloud resources daily, each tagged with a project name and a data sensitivity label. Security wants access to be granted automatically when a user's project attribute matches a resource's project tag, without creating a new role for every project. Which access control model fits best?

Attribute-based access control makes authorization decisions by evaluating policies against attributes of the subject, the resource, the action and the environment at the time of each request. A single policy such as allow access when the user's project attribute equals the resource's project tag scales automatically as resources are created and tagged, with no new roles or grants per project, and sensitivity labels can be added as further conditions. That matches dynamic cloud environments where resources are created continuously. Role-based access control assigns permissions through roles; implementing per-project access requires creating and maintaining a role for every project, which the scenario explicitly wants to avoid and which leads to role explosion. Discretionary access control leaves decisions to each resource owner, producing inconsistent and manual grants rather than automatic, policy-driven access. Mandatory access control uses hierarchical clearances and classifications enforced by the system; it can use the sensitivity label but cannot express matching on arbitrary project attributes, and it is rigid for fast-changing cloud resources. Exam caveat: ABAC depends on trustworthy attributes, so tagging must be enforced and protected from tampering by users. Operational check: create a resource with a project tag and confirm a matching user gains access while a user from another project is denied.