Which statement correctly differentiates RBAC and ABAC in access control?

• A. RBAC uses attributes and rules; ABAC assigns permissions by role.
• B. RBAC uses context to grant access; ABAC defines permissions by organization unit.
• C. RBAC assigns permissions by user identity only; ABAC uses access time.
• D. RBAC assigns permissions by role; ABAC uses user attributes and context to grant access.

Answer: (D)