Access rights tied to specific actions or transactions?

• A. RBAC
• B. Security Labels
• C. Need-to-Know Principle
• D. Transaction-based Rights

Answer: (D)

Focusing access rights on specific actions or transactions means granting permissions for exact operations rather than broad tasks. This is fine-grained authorization: a user can be allowed to perform a particular action on a transaction—such as initiating, approving, reversing, or auditing—without being given broader access to related systems or data. This matches the need to implement least privilege, reducing risk by ensuring only the necessary actions are permitted for a given role or user.

For example, in a financial workflow, one person might be allowed to initiate a payment, another to approve it, and another to void or audit a transaction. Each permission is tied to a specific action on a transaction, rather than the person simply having a general role with wide access. This approach contrasts with other concepts: RBAC assigns rights based on roles, which can grant broad access; security labels control data access based on data classification; and the need-to-know principle restricts access to information based on necessity, not necessarily to particular actions within a process.

By attaching rights to the actions themselves, systems can enforce tighter control over what a user can do at the moment a transaction is processed, which is precisely what transaction-based rights describe.