# Risk-Based Access Control Model: A Systematic Literature Review
## 6 Discussion
* **Access Policies**: They are primarily utilized by the access control manager (risk estimation module in the risk-based access control model) to specify access decisions. These policies are designed by the resource owner or security system administrator to classify terms and situations of granting or denying access to a particular resource. In the risk-based control model, the estimated risk value resulted from the risk estimation module is compared against risk policies to decide whether granting or denying access [41]. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Citation** & \begin{tabular}{c} **Benefits** \\ **of User** \\ \end{tabular}  & \begin{tabular}{c} **Action** \\ **Severity** \\ \end{tabular}  & \begin{tabular}{c} **Resource** \\ **Sensitivity** \\ \end{tabular}  & \begin{tabular}{c} **Outcomes of** \\ **ACTIONS** \\ \end{tabular}  & \begin{tabular}{c} **Context** \\ **Tust** \\ \end{tabular}  & \begin{tabular}{c} **Risk** \\ **History** \\ \end{tabular}  & \ \begin{tabular}{c} **Access** \\ **Policies** \\ \end{tabular}  & \begin{tabular}{c} **Role** \\ **Role** \\ \end{tabular}  \\ \hline [PERSON] et al. [22] & - & \(\surd\) & \(\surd\) & - & - & - & - & - & - \\ \hline [PERSON] et al. [4] & \(\surd\) & - & - & - & - & - & - & - \\ \hline [PERSON] et al. [20] & & & \(\surd\) & & & & & \\ \hline [PERSON] et al. [1] & - & - & - & - & - & - & \(\surd\) & - & - \\ \hline [PERSON] et al. [23] & - & - & - & - & \(\surd\) & - & - & - & - \\ \hline [PERSON] et al. [6] & - & - & \(\surd\) & - & - & \(\surd\) & - & - \\ \hline [PERSON] et al. [24] & - & \(\surd\) & \(\surd\) & - & - & \(\surd\) & - & - \\ \hline [PERSON] and [PERSON] [26] & - & - & - & - & - & \(\surd\) & - & \(\surd\) \\ \hline [PERSON] et al. [27] & - & - & - & \(\surd\) & \(\surd\) & - & \(\surd\) & - \\ \hline [PERSON] et al. [28] & - & - & - & - & \(\surd\) & - & - & - \\ \hline [PERSON] and [PERSON] [29] & - & \(\surd\) & \(\surd\) & - & \(\surd\) & - & \(\surd\) & - \\ \hline [PERSON] et al. [30] & - & - & - & - & - & - & \(\surd\) & - & - \\ \hline [PERSON] et al. [5] & - & - & - & - & - & \(\surd\) & \(\surd\) & - & - \\ \hline [PERSON] \& [PERSON] [15] & - & - & - & \(\surd\) & - & - & - & - \\ \hline [PERSON] et al. [31] & - & - & - & - & \(\surd\) & - & - & - & \(\surd\) \\ \hline [PERSON] et al. [32] & \(\surd\) & - & - & \(\surd\) & \(\surd\) & - & - & \(\surd\) & - \\ \hline [PERSON] et al. [33] & - & - & - & \(\surd\) & - & - & - & - & - \\ \hline [PERSON] et al. [34] & - & - & \(\surd\) & - & - & - & - & - & - \\ \hline [PERSON] and [PERSON] [35] & - & - & - & - & \(\surd\) & - & - & - & - \\ \hline [PERSON] et al. [36] & - & - & \(\surd\) & \(\surd\) & - & \(\surd\) & - & \(\surd\) \\ \[PERSON] et al. [37] & - & - & - & - & - & - & - & \(\surd\) & - \\ \hline [PERSON] et al. [38] & - & - & - & \(\surd\) & - & - & - & - \\ \hline [PERSON] and [PERSON] [9] & \(\surd\) & - & - & - & - & - & - & - \\ \hline [PERSON] et al. [40] & \(\surd\) & \(\surd\) & \(\surd\) & - & - & - & - & - \\ \hline [PERSON] et al. [41] & - & \(\surd\) & \(\surd\) & - & \(\surd\) & - & \(\surd\) & - \\ \hline [PERSON] et al. [42] & - & \(\surd\) & \(\surd\) & - & \(\surd\) & - & \(\surd\) & - \\ \hline [PERSON] et al. [44 The results show that risk factors used to implement risk-based access control models are significantly based on the context where the risk-based access control model will be deployed. However, several risk factors can be applied in various contexts. Reviewing risk factors used in risk-based access control models of retrieved publications reveal that \"Risk History\" was the dominant risk factor in most risk-based access control models in which it was adopted in 18 publications, as depicted in Figure 7. This should be normal or expected, as any risk model would or should use their previous risk values given to a user/subject to assess their current and future access. In addition, the context was one of the significant risk factors used in 14 publications.