A security policy based on the identities and/or attributes of the object (system resource) being accessed and of the subject (user, group of users, process, or device) requesting access.
Source(s):
NIST SP 800-33
[Withdrawn]