Policy-based access control (PBAC) and attribute-based access control (ABAC) are both frameworks that use attributes to make authorization decisions. However, with PBAC, you can write policies in a high-level policy language that shows the authorization engine what to do in a certain situation. With ABAC, you generally need to tell the authorization engine how to do it as well.