Content-Dependent Access Control

Content-dependent control is another technique used, which is based on the object’s
content that the subject is trying to access. It is usually implemented in databases.
For example, a database may contain sensitive medical information; the
more sensitive this data is, the fewer the number of people thatwill be able to access
it. Let’s say the database holds the results of different tests that have been
performed on a particular patient. If a lab technician requests to see these results,
she may be shown only that the tests were completed successfully, on what date,
and by whom. If a nurse requests to see this information, she may be given access
to a little bitmore of the information than the lab technician, but not sensitive
information, as in the patient has positive signs of malaria. And when a
physician requests to see the same set of information, she may have access to all
test data and results.
Content-dependent access controls require a lot of resources and overhead
because the database will need to scan the object to determine if a particular
subject can actually access it. The more granularity that is configured and expected
from these types of controls will equate to more resources needed to
evaluate requests.