No user-to-role mapping. No per-request permission checks. Your environment fingerprint determines your key fragment. Change your location, and your access changes automatically.
In traditional systems, roles are stored in databases mapping users to permissions. XenSplit uses environmental fingerprints that map environments to access levels, not users to roles.
When you're at the office, your environment generates a manager key fragment that can decrypt sensitive data. When you're at home, the same environment generates only a viewer key fragment with limited access.
In a public environment, no valid key fragment is generated, preventing any access to sensitive data.
Traditional role-based access control stores user-to-role mappings in databases that can be compromised. An attacker who gains access to the database can modify roles or impersonate users.
With XenSplit's environment-based access, the database stores environment-to-role mappings, not user-to-role mappings. There are no per-request permission checks - the environment generates the key fragment needed for access. An attacker can't simply "change" their role without changing their physical environment.
Even if an attacker captures the environmental key from a home environment, it won't work for accessing manager data. The math simply won't allow it.