Performance Testing Framework

Your access control system is built: permissions, roles, attributes, temporal rules, HBAC, ABAC, and policy composition. Before deploying to production, you need to answer three questions:

Can the system handle your request volume at acceptable latency?
Does enabling caching, JIT, or host filtering actually improve your workload?
Has a code change introduced a performance regression?

The bac-perf tool answers all three. It generates realistic rule sets for HBAC, ABAC, LDAP ACI, POSIX ACL, and Windows Security Descriptors, runs benchmarks under controlled conditions, and compares results across implementations and runs.

Installation

cargo build --release --package perf-testing

The binary is at target/release/bac-perf.

Workflow overview

A typical performance validation session has three steps:

# 1. Generate a fixture matching your production profile
bac-perf generate --bac-type hbac --count 1000 --distribution sssd-prod \
  --output prod_1k --seed 42

# 2. Run benchmarks
bac-perf bench --bac-type hbac --fixture prod_1k --scenario all --cache

# 3. Compare against a baseline
bac-perf compare baseline.json current.json

For ABAC, replace --bac-type hbac with --bac-type abac. You can also benchmark ABAC using HBAC fixtures for direct performance comparison (see Cross-BAC Benchmarking). bac-perf also generates and benchmarks ldap_aci, posix_acl, and win_sd fixtures the same way.

Architecture

graph TD
    A[perf-testing/] --> B[synthesis/<br/>Rule generation]
    A --> C[fixtures/<br/>JSON persistence]
    A --> D[runner/<br/>Benchmark execution]
    A --> E[cli/<br/>Command-line interface]

Synthesis generates rules for all five supported BAC types (HBAC, ABAC, LDAP ACI, POSIX ACL, Windows SD) using configurable distribution presets.
Fixtures persist generated rules as compressed JSON for reproducible benchmarks. HBAC fixtures can be benchmarked with both HBAC and ABAC.
Runner executes benchmark scenarios and collects latency, throughput, and memory metrics across all supported BAC types.
CLI ties everything together through the bac-perf command.

Quick example

Generate 1,000 HBAC rules with the SSSD production distribution, run all benchmark scenarios with caching enabled, and save the results:

bac-perf generate --bac-type hbac --count 1000 --distribution sssd-prod --output hbac_1k_prod --seed 42

bac-perf bench \
  --bac-type hbac \
  --fixture hbac_1k_prod \
  --scenario all \
  --cache \
  --format json \
  --output results/hbac_baseline.json

For ABAC:

bac-perf generate --bac-type abac --count 1000 --distribution sssd-prod --output abac_1k_prod --seed 42

bac-perf bench \
  --bac-type abac \
  --fixture abac_1k_prod \
  --scenario all \
  --cache \
  --format json \
  --output results/abac_baseline.json

Example terminal output:

Scenario: single_request_latency
Setup:
  BAC Type:         hbac
  Fixture:          hbac_1k_prod
  Rules loaded:     1000
  Memory usage:     454000 bytes (0.5 KB/rule)
  Index build time: 0.60 ms

Results:
  Requests:         10000
  Duration:         2.80 ms
  Throughput:       3571429 req/s

Latency:
  Min:              0.15 µs
  Mean:             0.28 µs
  Median:           0.27 µs
  P95:              0.35 µs
  P99:              0.41 µs
  Max:              0.52 µs
  Std Dev:          0.06 µs

See Performance Results for benchmark data across all rule counts from 100 to 1,000,000.

Distribution presets

Three presets model different deployment profiles:

Preset	user=all	host=all	svc=all	deny %	Groups
`sssd-prod`	15%	30%	40%	5%	dense (avg 10)
`dev`	40%	50%	60%	1%	sparse (avg 3)
`high-security`	5%	10%	15%	20%	very specific

Choose the preset that most closely matches your production rule distribution. This full breakdown (category=all ratios and groups) applies to HBAC and ABAC. For LDAP ACI, POSIX ACL, and Windows SD only the deny % column carries over; their pattern mix is otherwise fixed internally.

Benchmark scenarios

Scenario	What it measures
`single-latency`	Request latency with warm cache (10K matching requests)
`check-access-latency`	Same as `single-latency` but via `check_access()` instead of `evaluate()`
`uncached-latency`	Raw evaluation without cache benefit (10K unique requests)
`throughput`	Sustained load with 80/20 match/non-match mix
`build-time`	Policy load and index construction time
`all`	Run all of the above

Output formats

terminal (default) – human-readable tables.
json – machine-readable, suitable for bac-perf compare.
csv – spreadsheet-compatible.
markdown – condensed summary table (same fixed-width layout as the multi-result comparison view, not literal Markdown table syntax).

BAC Rules Documentation