Scenario-Based Methodology for Evaluating a Hybrid Access Control Method in University Information Systems

This paper presents a scenario-based methodology for evaluating a hybrid access control method intended for university information systems. The proposed approach combines role-based and attribute-based access control with contextual information, SIEM and EDR signals, and dynamic risk assessment. A structured set of ten evaluation scenarios is defined for student, lecturer, and administrative access, including normal conditions, insufficient permissions, changed context, increased risk, and critical security situations. The methodology also defines comparative criteria for examining the expected behaviour of traditional RBAC, RBAC combined with ABAC, and the proposed hybrid method. The presented scenarios do not represent completed experimental results, but provide a consistent basis for subsequent implementation and validation in a controlled university information system environment.