Situation
Many service providers (SPs) rely on externalized, attribute based access control (ABAC) to manage what end users can do. In research and academia, it is very common for an individual to have multiple relationships with an institution at the same time – any combination of student, employee, and alumni. A common way to reflect this for access control is to use the eduPerson ( https://refeds.org/eduperson) attribute called eduPersonScopedAffiliation.