To use the current time in an ABAC policy with Permit.io, you pass it as a user attribute in your

permit.check()

call and reference it in your condition set (1) . First, create a user attribute for

current_time

in the Permit dashboard under User Attributes . Then, in your condition set, you can compare

current_time

against other time-based attributes. For example, to check if access should expire based on time :

{
  "allOf": [
    {
      "user.time_based_groups": {
        "any_match": {
          "match": {
            "expires": {
              "greater-than-equals": {
                "ref": "user.current_time"
              }
            }
          }
        }
      }
    }
  ]
}

When making the permission check, pass

current_time

as a user attribute :

const permitted = await permit.check(
  {
    key: "<mailto:george@test.com|george@test.com>",
    attributes: {
      current_time: new Date() .getTime() ,
    },
  },
  "patch",
  {
    type: "_internal_api",
    tenant: "coke",
  }
) ;

To learn more, see the sources I considered: [[1] Time Based Role Example](https://docs.permit.io/how-to/build-policies/abac/time-based-role)

#C02RTML2WNN can I use context attributes in ABAC policies?

Based on the available sources, I don't have specific documentation about using context attributes in ABAC policies or how to handle time-based attributes when calling the

authorized_users

endpoint (1) (2) . The sources explain that ABAC uses four types of attributes: Subject Attributes (user-related) , Resource Attributes, Action Attributes, and Environmental Attributes (including time, location, and device) (1) . However, the specific implementation details for passing context attributes separately from user attributes, or how to use them with the

authorized_users

endpoint, are not covered in the available documentation (1) (2) . For the

authorized_users

endpoint specifically and how to pass context/environmental attributes in that context, I'd recommend reaching out for clarification. Would you like me to provide a general answer based on my broader knowledge of how context attributes typically work in authorization systems, or would you prefer to wait for offic

To learn more, see the sources I considered: [[1] What Is Attribute-Based Access Control (ABAC)?](https://www.permit.io/blog/what-is-abac) [[2] How to Implement Attribute-Based Access Control (ABAC) Authorization?](https://www.permit.io/blog/how-to-implement-abac)

Environmental attributes in ABAC represent the broader context of each access request (1) . These include factors like time and location of an access attempt, the subject's device, communication protocol, and encryption strength . For example, an environmental attribute policy might state: "Jessica can only use her company credit card to purchase a subscription during her working hours, and as long as she is in the USA and connected to the company secure network" . When implementing ABAC with environmental attributes, you pass them through the

permit.check()

function (2) . Here's an example structure:

const permitted = await permit.check(
    {
        key: "<mailto:john@permit.io|john@permit.io>",
        attributes: {
            location: "England",
            department: "Engineering",
        },
    },
    {
        type: "create",
    },
    {
        type: "document",
        attributes: {
            hasApproval: "true",
        },
        tenant: "companyB",
    }
) ;

In this example,

location

is an environmental attribute that can be used in your ABAC policy conditions . The environmental context (time, location, device) is evaluated alongside subject attributes, resource attributes, and action attributes to make the authorization decision (1) .

To learn more, see the sources I considered: [[1] Components](https://docs.permit.io/how-to/build-policies/abac/components) [[2] How to Implement Attribute-Based Access Control (ABAC) Authorization?](https://www.permit.io/blog/how-to-implement-abac)