Hasura implements RBAC by automatically publishing a different GraphQL schema that represents the right queries, fields, and mutations that are available to that role.
For ABAC, session variables can be used as attributes and permission rules can be created that can use any dynamic variable that is a property of the request.