Mattermost ABAC Use Cases
Pillar 1: Attribute-based Membership
Controls who belongs to channels and teams based on user attributes. Evaluated at membership sync time (not request time). Environmental attributes are not permitted in this pillar.
M1. Cross-Project "Conflict of Interest"
Segment: Legal / Consulting
Business Need: In big law or consulting, a "Chinese Wall" must exist between teams working for competing clients.
Rule:
IF user.assigned_clients CONTAINS 'Client_A'
THEN DENY channel_access
WHERE resource.client == 'Client_B'
Scenario: If an analyst is moved to "Project Apple," the ABAC system automatically detects the conflict and blocks them from entering any channels or viewing any files tagged with "Project Samsung," even if they are a "System Admin."
M2. Clearance-Tiered Team Membership
Segment: Defense / Intelligence
Business Need: Defense contractors must segment collaboration spaces by classification level and automatically provision/deprovision users as clearances change.
Rule:
IF user.clearance_level >= 'Secret'
THEN ADD_TO team.classified_programs
Scenario: A defense contractor uses Mattermost teams to segment work by classification level. Users are automatically provisioned into the "CLASSIFIED-PROGRAMS" team only if their HR-synced clearance attribute meets the threshold. When a clearance is downgraded (e.g., employee moves to commercial division), they're automatically removed at next sync.
M3. Program/Contract Auto-Enrollment
Segment: Federal Contractors
Business Need: Large contractors work dozens of programs simultaneously and need automatic channel provisioning based on program assignment.
Rule:
IF user.program_codes CONTAINS 'PROGRAM-ZEUS'
THEN ADD_TO channel.zeus-engineering
AND ADD_TO channel.zeus-comms
Scenario: Rather than manual channel invites, users are auto-enrolled into all relevant program channels when their program_codes attribute (synced from the HRIS/contract management system) includes that program. Offboarding from a program triggers automatic removal.
M4. Regional Compliance Segmentation
Segment: Global Enterprises / Financial Services
Business Need: Multinational organizations must ensure employees collaborate in regionally-appropriate teams for data residency compliance.
Rule:
IF user.data_jurisdiction == 'EU'
THEN ADD_TO team.eu-operations
IF user.data_jurisdiction == 'US'
THEN ADD_TO team.us-operations
Scenario: A multinational bank must ensure EU employees collaborate in EU-hosted teams and US employees in US-hosted teams for data residency compliance. Membership is determined by the user's data_jurisdiction attribute, ensuring employees can't accidentally be added to the wrong regional team by an admin.
M5. Organizational Hierarchy Channel Mapping
Segment: Government Agencies / Large Enterprises
Business Need: Government agencies and large enterprises need channels to automatically reflect organizational structure without manual administration.
Rule:
IF user.department == 'Cybersecurity'
AND user.division == 'Operations'
THEN ADD_TO channel.ciso-ops-all
AND ADD_TO channel.{user.branch}-ops
Scenario: The Department of Homeland Security has hundreds of organizational units. When an employee transfers from the "Infrastructure Security Division" to the "Cybersecurity Division," their Mattermost channel memberships automatically update to reflect their new org unit. They're removed from infrastructure channels and added to cybersecurity channels—no tickets, no admin action, no access gaps or lingering permissions.
M6. Mission/Task Force Dynamic Assignment
Segment: Defense / Emergency Management / Intelligence
Business Need: In crisis response or military operations, ad-hoc task forces form and dissolve rapidly. Channel membership must reflect real-time mission assignment.
Rule:
IF user.active_missions CONTAINS 'HURRICANE-RESPONSE-2024'
THEN ADD_TO channel.hurricane-response-command
AND ADD_TO channel.hurricane-response-{user.assigned_sector}
Scenario: FEMA activates a hurricane response operation. As personnel are assigned to the mission in the resource management system, they're automatically added to the central command channel and their sector-specific coordination channel. When they're released from the mission (attribute removed), they lose access immediately—ensuring the channels only contain active responders and preventing information sprawl post-incident.
Pillar 2: Attribute-based Access Control (Request-based)
Controls what actions users can perform at request time. Evaluates user attributes, resource attributes, and environmental attributes (session context, device posture, time, location, system state) dynamically per request.
A1. Tactical Data Sovereignty
Segment: Defense / Intelligence (NATO, Multi-agency)
Business Need: In joint operations (e.g., NATO or multi-agency task forces), users from different nations share the same server but data must remain restricted by national origin.
Rule:
IF user.nationality == 'USA'
AND resource.classification == 'Top Secret'
THEN GRANT file.download
Scenario: A British officer and a US officer are in the same channel. Both see the message "Satellite imagery attached." The US officer can download the TIFF file; the British officer sees the message but receives an "Access Denied" overlay on the file attachment because their nationality attribute doesn't match the resource.origin metadata.
A2. The "Clean Room" Protocol
Segment: R&D / Intellectual Property / Defense Contractors
Business Need: Enterprises need to ensure that even if a contractor is invited to a project channel, they cannot exfiltrate data.
Rule:
IF user.employment_type == 'Contractor'
THEN DENY file.upload
AND DENY file.download
Scenario: A contractor can read the chat history to stay informed on project status but is restricted from uploading any source code or downloading any architectural diagrams. This mitigates the risk of IP theft while maintaining the flow of communication.
A3. High-Security Feature Gating
Segment: Executive / Legal / Government
Business Need: Not every user needs—or should have—access to high-security features like E2EE or Burn-on-Read. These can complicate e-discovery or compliance if overused.
Rule:
IF user.clearance_level < 5
THEN DISABLE_FEATURE e2ee
AND DISABLE_FEATURE burn_on_read
Scenario: A government agency wants E2EE available for the "Cabinet" and "Legal" teams to discuss sensitive litigation, but they want it disabled for general staff to ensure all standard communications remain searchable for public record requests (FOIA).
A4. Geofenced Compliance
Segment: Global Financial Services
Business Need: Global banks must comply with strict data residency and privacy laws (GDPR, financial regulations) that dictate data cannot leave a specific physical jurisdiction.
Rule:
IF user.current_location != 'EU'
AND resource.data_residency == 'EU'
THEN DENY file.view
Scenario: An employee normally based in Paris travels to a high-risk region for vacation. Based on their current_IP_geofence attribute, Mattermost automatically restricts their ability to view sensitive financial spreadsheets attached to messages until they return to a "safe" zone, preventing accidental regulatory violations.
Environmental Attributes: user.current_location (derived from session IP)
A5. Need-to-Know Enforcement
Segment: Intelligence / Federal
Business Need: In an "all-source" intelligence environment, users often have broad clearances but restricted "need-to-know" for specific operations.
Rule:
IF user.compartment != resource.compartment
THEN DENY message.search
AND DENY file.view
Scenario: A user with Top Secret clearance is in a joint task force channel. They can chat, but they cannot search for or see historical files related to "Operation Gray Wolf" because their profile doesn't have the specific Gray Wolf compartment attribute. This prevents lateral "snooping" even within the same clearance level.
A6. ITAR/EAR Export Control Compliance
Segment: Defense Manufacturing
Business Need: Defense contractors must ensure that technical data (blueprints, specs) is never "exported" to non-US persons, even those working within the same company.
Rule:
IF resource.export_controlled == TRUE
AND user.citizenship != 'USA'
THEN DISABLE_FEATURE file.download
Scenario: An engineer in a global defense firm uploads a jet engine schematic. A colleague in the UK office can view the thumbnail and discuss it in chat (collaboration), but the Download button is programmatically disabled/hidden for them to remain ITAR compliant.
A7. Shift-Based Command Access
Segment: Emergency Services / NOC / Critical Infrastructure
Business Need: In mission-critical operations, "Admin" or "Controller" powers should only exist while the person is actually on duty.
Rule:
IF user.is_on_shift == FALSE
THEN REVOKE permission.channel_admin
AND REVOKE permission.broadcast
Scenario: A Watch Officer has the power to "Broadcast" to the entire agency during their 12-hour shift. The moment their shift ends in the HRIS (synchronized via LDAP), Mattermost dynamically strips the Broadcast permission, preventing accidental or unauthorized "All Hands" alerts while they are off-duty.
Environmental Attributes: user.is_on_shift (derived from HRIS/schedule system)
A8. Device Posture-Based Sanitization
Segment: Zero Trust / Remote Work / Government
Business Need: High-security customers need to distinguish between a "hardened" government laptop and a personal mobile device.
Rule:
IF device.is_managed == FALSE
THEN DENY file.upload
AND FORCE_FEATURE burn_on_read
Scenario: An executive checks Mattermost from their personal iPad at an airport. Because the device is unmanaged, they can read messages, but all incoming messages are automatically set to Burn-on-Read (deleted after viewing), and they are blocked from uploading any documents from the device.
Environmental Attributes: device.is_managed, device.compliance_status
A9. PII Masking for Support Tiers
Segment: Finance / Insurance / Healthcare
Business Need: Financial institutions need to protect customer data (SSNs, account numbers) from lower-tier employees who handle general inquiries.
Rule:
IF user.support_tier < 3
AND resource.contains_PII == TRUE
THEN MASK_CONTENT
Scenario: A customer posts a screenshot containing a bank statement in a support channel. Tier 1 agents see the image as blurred/redacted with a "Higher Clearance Required" overlay. Only a Tier 3 Manager has the attribute required to "unmask" the image.
A10. Active Incident Escalation
Segment: SOC / Cybersecurity / Critical Infrastructure
Business Need: Permissions should be dynamic based on the state of the organization (e.g., Threat Level).
Rule:
IF system.threat_level == 'RED'
THEN RESTRICT_TO user.clearance >= 7
AND DISABLE_FEATURE external_links
Scenario: During an active ransomware attack, the System Admin flips a "Global Threat Level" attribute. Mattermost instantly restricts access to the "War Room" channels to only users with a high incident_response score and disables the ability to post external URLs to prevent further phishing or C2 callbacks.
Environmental Attributes: system.threat_level (global system state)
A11. Multi-Agency Siloed Search
Segment: Gov Cloud / Shared Services
Business Need: Large government agencies often share a single Mattermost instance but must keep their data legally separate.
Rule:
IF user.agency_id != resource.agency_owner_id
THEN HIDE resource.metadata
Scenario: When a user from the "Department of Energy" performs a global search, the ABAC engine filters out any results or file attachments owned by the "Department of Interior," even if they are in "Public" channels. It effectively creates a "virtual silo" within a single server.
A12. Evidence Chain-of-Custody
Segment: Legal / Law Enforcement
Business Need: In legal proceedings, certain files must be "locked" so they cannot be modified or deleted, even by the original uploader.
Rule:
IF resource.status == 'evidence'
THEN DENY message.edit
AND DENY file.delete
Scenario: Once a file in a "Crime Scene Investigation" channel is tagged as evidence, the user who uploaded it loses the ability to delete or edit the message. This ensures an immutable audit trail for court, solving a major compliance headache for law enforcement.
A13. Just-In-Time (JIT) Contractor Onboarding
Segment: Supply Chain / Federal Contractors
Business Need: Contractors often need access for a very specific window (e.g., a 48-hour audit).
Rule:
IF user.contract_end_date < CURRENT_TIME
THEN DENY login
Scenario: Rather than relying on an admin to remember to deactivate a contractor's account, the ABAC engine checks the contract_end_date attribute from the Identity Provider at every login attempt. Access is revoked precisely at the second the contract expires.
Environmental Attributes: CURRENT_TIME (system time at request)
A14. Classification Downgrade Prevention
Segment: Defense / Intelligence
Business Need: Prevent users from inadvertently "downgrading" classified content by posting in channels where they have read-only awareness.
Rule:
IF resource.classification > user.max_writable_classification
THEN DENY message.post
AND DENY file.upload
Scenario: An analyst with "Secret" clearance is in a "Top Secret" channel for read-only awareness. ABAC ensures they cannot post messages or upload files that could inadvertently "downgrade" TS content by associating it with their lower clearance. The channel remains collaborative for TS-cleared users while enforcing write restrictions dynamically.
A15. MFA Step-Up for Sensitive Actions
Segment: Critical Infrastructure / Financial Services
Business Need: High-risk actions should require recent re-authentication, even within an active session.
Rule:
IF action == 'file.download'
AND resource.sensitivity == 'critical'
AND session.mfa_age_minutes > 15
THEN REQUIRE_REAUTHENTICATION
Scenario: A power grid operator views SCADA documentation in Mattermost. When they attempt to download a critical infrastructure diagram, the system checks their session's MFA timestamp. If more than 15 minutes have passed since last MFA, they're prompted to re-authenticate before the download proceeds—implementing "step-up auth" for high-risk actions.
Environmental Attributes: session.mfa_age_minutes
A16. Simultaneous Session Restriction
Segment: Insider Threat Mitigation / High Security
Business Need: Prevent credential sharing or compromised accounts from bulk-exfiltrating data.
Rule:
IF session.concurrent_count > 1
AND action IN ['file.download', 'message.export']
THEN DENY
Scenario: To prevent credential sharing or compromised accounts from bulk-exfiltrating data, ABAC denies download and export actions when the user has multiple active sessions. A legitimate user must close other sessions before performing sensitive actions, while an attacker using stolen credentials alongside the real user is blocked.
Environmental Attributes: session.concurrent_count
Summary
Pillar | Use Cases | Environmental Attributes | License Tier |
|---|---|---|---|
Attribute-based Membership | 6 | ❌ Not permitted | Enterprise / Enterprise Advanced |
Attribute-based Access Control | 16 | ✅ Core capability | Enterprise Advanced |
Appendix: Actions Covered
Action | Use Case Count | Priority |
|---|---|---|
| 6 | High |
| 4 | High |
| 4 | High |
| 4 | Medium |
| 2 | Medium |
| 2 | Medium |
| 1 | Medium |
| 1 | Medium |
| 1 | Low (session-level) |
| 2 | Low (admin-level) |