Which of the following allows a network administrator to implement an access control policy based on individual user characteristics and NOT on job function?

ABAC evaluates policies against a set of attributes associated with the user, the resource, and the environment at the time of the access request. This allows fine-grained, individual-level access decisions that go beyond broad job function groupings, satisfying the requirement for characteristics-based control.

Implicit deny is a default-deny rule stating that anything not explicitly permitted is blocked; it is a policy stance, not an access control model based on user characteristics.

Role-based access control (RBAC) assigns permissions to roles and then assigns users to those roles - it is explicitly based on job function, which the question rules out.

Rule-based access control applies static, predefined rules (e.g., time-of-day restrictions) rather than evaluating individual user characteristics.