Performance Testing Framework

Your access control system is built: permissions, roles, attributes, temporal rules, HBAC, ABAC, and policy composition. Before deploying to production, you need to answer three questions:

Can the system handle your request volume at acceptable latency?
Does enabling caching, JIT, or host filtering actually improve your workload?
Has a code change introduced a performance regression?

The bac-perf tool answers all three. It generates realistic rule sets for both HBAC and ABAC, runs benchmarks under controlled conditions, and compares results across implementations and runs.

Installation

cargo build --release --package perf-testing

The binary is at target/release/bac-perf.

Workflow overview

A typical performance validation session has three steps:

# 1. Generate a fixture matching your production profile
bac-perf generate --bac-type hbac --count 1000 --distribution sssd-prod \
  --output prod_1k --seed 42

# 2. Run benchmarks
bac-perf bench --bac-type hbac --fixture prod_1k --scenario all --cache

# 3. Compare against a baseline
bac-perf compare baseline.json current.json

For ABAC, replace --bac-type hbac with --bac-type abac. You can also benchmark ABAC using HBAC fixtures for direct performance comparison (see Cross-BAC Benchmarking).

Architecture

graph TD
    A[perf-testing/] --> B[synthesis/<br/>Rule generation]
    A --> C[fixtures/<br/>JSON persistence]
    A --> D[runner/<br/>Benchmark execution]
    A --> E[cli/<br/>Command-line interface]

Synthesis generates HBAC and ABAC rules using configurable distribution presets.
Fixtures persist generated rules as compressed JSON for reproducible benchmarks. HBAC fixtures can be benchmarked with both implementations.
Runner executes benchmark scenarios and collects latency, throughput, and memory metrics for both HBAC and ABAC.
CLI ties everything together through the bac-perf command.

Quick example

Generate 1,000 HBAC rules with the SSSD production distribution, run all benchmark scenarios with caching enabled, and save the results:

bac-perf generate --bac-type hbac --count 1000 --distribution sssd-prod --output hbac_1k_prod --seed 42

bac-perf bench \
  --bac-type hbac \
  --fixture hbac_1k_prod \
  --scenario all \
  --cache \
  --format json \
  --output results/hbac_baseline.json

For ABAC:

bac-perf generate --bac-type abac --count 1000 --distribution sssd-prod --output abac_1k_prod --seed 42

bac-perf bench \
  --bac-type abac \
  --fixture abac_1k_prod \
  --scenario all \
  --cache \
  --format json \
  --output results/abac_baseline.json

Example terminal output:

Scenario: single_request_latency
Setup:
  Rules loaded:     1000
  Memory usage:     454000 bytes (0.5 KB/rule)
  Index build time: 0.6 ms

Results:
  Requests:         10000
  Throughput:       3.5M req/s

Latency:
  Mean:             280 ns
  Median:           270 ns
  P95:              350 ns
  P99:              410 ns

See Performance Results for benchmark data across all rule counts from 100 to 1,000,000.

Distribution presets

Three presets model different deployment profiles:

Preset	user=all	host=all	svc=all	deny %	Groups
`sssd-prod`	15%	30%	40%	5%	dense (avg 10)
`dev`	40%	50%	60%	1%	sparse (avg 3)
`high-security`	5%	10%	15%	20%	very specific

Choose the preset that most closely matches your production rule distribution.

Benchmark scenarios

Scenario	What it measures
`single-latency`	Request latency with warm cache (10K matching requests)
`uncached-latency`	Raw evaluation without cache benefit (10K unique requests)
`throughput`	Sustained load with 80/20 match/non-match mix
`build-time`	Policy load and index construction time
`all`	Run all of the above

Output formats

terminal (default) – human-readable tables.
json – machine-readable, suitable for bac-perf compare.
csv – spreadsheet-compatible.
markdown – documentation-ready tables.

BAC Rules Documentation