Attribute Based Access Control

BioT utilizes two authorization measures to control API access and data permissions:

Static Access Control: The JWT token issued upon login determines which APIs a user can access
Attribute Based Access Control (ABAC). This security mechanism controls the specific data a user can access.

BioT first applies Static Access Control. If authorized, Attribute-Based Access Control is then evaluated.

For example, once logged in, ABAC prevents patients from creating other patient profiles and restricts non-caregiver users from accessing protected health information PHI they shouldn't see.

The system is composed of a global service that monitors all incoming API traffic to the platform. Each request is scanned to make sure that the only authorized data is accessed, manipulated and returned as part of the API response.

The platform arrives with a default ABAC implementation that can serve as a basis to reduce the configuration required by the system administrator. Here are the details of the default implementation:

The platform also arrives with a single organization for the manufacturer. Other organization entities, representing care provider organizations, may be created.

Static Access Control

Each user can access different APIs in BioT.

Manufacturer Admin: Can access all APIs in the platform.
Manufacturer Operator: can access all APIs with PROTECTED_API permission. (Each APi permission can be found in it's documentation page)
Organization Admin: can access all APIs with PROTECTED_API permission and the resend invitation API.
Organization Operator: can access all APIs with PROTECTED_API.
Caregiver: can access all APIs with PROTECTED_API.