RBAC grants an agent access based on its role, while ABAC grants access based on attributes evaluated at run time. RBAC, built on the NIST role-based access control model, keeps permissions small and auditable by tying them to roles. ABAC, defined in NIST SP 800-162, adds context such as the requested action, data sensitivity, time, and location. For agents the two work together: RBAC bounds what an agent may ever do, and ABAC decides whether this specific request fits the context, so a role that permits an action type does not automatically permit every instance of it.