Cognition Behind Access Control: A Usability Comparison of Rule- and Category-Based Mechanisms

Usability of a security mechanism has a notable impact on its efficacy. For instance, if users do not understand how to use the mechanism, they will make frequent mistakes. Given the magnitude of the problem, it seems desirable to understand what underlies the usability of security solutions. To achieve this, one needs to rely on solid theoretical foundation of human perception. In this paper, we investigate a problem of access control usability in the light of cognitive science. We rely on evidence from cognitive psychology and compare two systems that regulate access based on rules and categories. We perform a user-study of two approaches (N = 46). Our study reveals that a category-based approach has a higher perceived usability in terms of mental load and user performance. These results allow us to formulate recommendations for designers of access control systems.