[USENIX Security '18 - Solving the Next Billion-People Privacy Problem](https://www.youtube.com/watch?v=Pogo3QD5LpU&list=PLbRoZ5Rrl5lew16BZO_C6wihpBkAYYaxi&index=33) There is a nice example of attribute-based access control vs identity-based access control in there.