Authorization Terminology Is a Mess: Let's Fix It

Authorization terminology has accumulated for decades, leading to confusion where terms like RBAC, ABAC, MAC, and PBAC are often compared as if they were competing models. This article argues they answer different questions and proposes a taxonomy of six axes, each addressing a distinct aspect of authorization systems: administration, model, policy, information, decision, and enforcement. By separating these concerns, familiar labels can be placed on the right axis, clarifying their relationships and reducing miscommunication.