Attribute-Based Access Control (ABAC) would have stopped it.
ABAC isn’t just another access control model. It makes decisions using attributes: the who, what, where, when, and why of a request. Instead of static roles, ABAC evaluates context in real time. Attributes can be anything—user department, device type, request time, data sensitivity level. This makes it far more precise and secure than role-based access control when it comes to protecting Personally Identifiable Information (PII).
PII data demands stronger controls. Names, addresses, Social Security numbers, IP addresses—each piece is a potential breach headline. With ABAC, policies aren’t written in rough strokes. They are fine-grained rules enforced every time data is accessed. A request to read an email address at 3 a.m. from an unknown IP can be denied instantly. A system admin with broad privileges can still be blocked from seeing financial details if the attributes don’t match the policy.
The real power is in dynamic policies. Instead of rewriting roles every time regulations or business needs shift, you adjust attributes or rules. GDPR, CCPA, HIPAA—compliance becomes a matter of keeping your attributes accurate and your policies strict. This minimizes blast radius, protects sensitive workloads, and reduces the risk of insider threats or accidental exposure.