# SEC02-BP06: Leverage user groups and attributes

## Description

Group-based access control.

## Implementation Guidance

- Role-based access via groups
- Attribute-based access control
- Group membership automation
- Regular group reviews
- Hierarchical groups

## Risk Level

Medium - Individual permissions don't scale.
