How stubborn is XACML?

Question

ERP

It's hard for me to imagine what the system should be like.

1. As I understand it, it will be cheaper to take it to a microservice, right?
   
2. What is the size of the application, the company to use such a tool?
   
3. In what situations and under what tasks can it be rationally, consciously applied?
   

As I understand it, everyone implements RBAC, the maximum ACL is self-written, simple or more advanced. This covers 99% of cases, although it imposes restrictions in terms of flexibility. Less common ABAC and more advanced XACML are the most flexible examples I've seen, but a clear overkill for almost all projects. RBAC and ACL are good, but up to a certain point.
Until you have 100,000+ roles or 1,000,000,000,000+ AE entries in the

Attribute-Based Access Control in Symfony

UPD ACL. In the end, I implemented a simple ACL specifically for my domain, which is much better than digging into the hierarchy of roles or multi-roles in RBAC.

Answer 1

He did not overkill because many libraries and services implement it today. You don't even need to know about it. Look towards casbin or OpenPolicyAgent