Authorization Glossary

Browse 26 authorization terms defined in plain English, from the cultural dictionary of computing.

26 Authorization Terms

ABAC
Attribute-Based Access Control -- an authorization model where access decisions are based on attributes of the user (department, clearance), resource...
Access Token
A credential used by a client or service to access protected resources on behalf of a user or itself, often with scoped permissions and limited lifetime. In...
Attribute-Based Access Control
An access-control model where authorization decisions are based on attributes of the user, resource, action, and environment rather than only on fixed roles....
Authorization Code
A short-lived code used in OAuth authorization flows that a client exchanges for tokens after the resource owner authorizes access. It reduces exposure...
Authorization Flow
The sequence of checks and decisions that determines whether an authenticated identity may perform a requested action or access a resource. Authorization flows...
Authorization Handler
A component that evaluates one or more authorization rules or policies for a request and decides whether the action should proceed. Authorization handlers...
Authorization Middleware
Middleware that enforces access rules on requests after identity has been established but before business logic executes. It is commonly used to apply...
Authorization Policy
A defined rule set describing who may perform which actions on which resources under what conditions. Authorization policies can be static role rules or more...
Authorization Server
The component in an authorization framework that authenticates users, obtains consent, and issues tokens to clients. In OAuth-based systems, the authorization...
Claims-Based Identity
An identity model where information about a user or entity is expressed as claims in tokens or assertions, and systems make decisions based on those claims. It...
Code Flow
Usually shorthand for the OAuth authorization code flow, where a client obtains an authorization code and exchanges it for tokens. It is widely used because it...
FedRAMP
Short for Federal Risk and Authorization Management Program, the US framework used to standardize security assessment and authorization for cloud services used...
Group Membership
A user's or system's inclusion in an access-control group that grants permissions, roles, or policy scope. Group membership is fundamental in directory...
Identity Management
The administration of identities, credentials, authentication flows, and access relationships across systems and services. Identity management includes...
IDOR
Insecure Direct Object Reference — a vulnerability where an application exposes internal object IDs (user IDs, file names, database keys) in API endpoints...
MPA
An abbreviation that can refer to multi-party approval or similar shared-authorization concepts, where more than one person must approve a sensitive action...
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their accounts on another service without...
Permission
A rule or attribute that grants or denies a subject (user, role, or process) the ability to perform a specific action on a resource. In Unix, file permissions...
Permission Model
The design by which a system defines, groups, grants, and enforces permissions for users, services, and other identities. A good permission model makes least...
Policy Engine
A service or library that evaluates declarative policy rules and returns allow, deny, or advisory decisions. It shows up in application security, identity,...
Principle of Least Privilege
A security principle that users, services, and applications should receive only the minimum permissions needed to perform their intended tasks and no more. It...
RBAC
Role-Based Access Control -- an authorization model where permissions are assigned to roles (admin, editor, viewer), and users are assigned roles. Simplifies...
Resource Access
The ability of a user, process, or service to reach and use a protected resource such as a file, database, API, queue, or device. Security architecture...
Role
A named collection of permissions or privileges that can be assigned to users, services, or processes to control what actions they are authorized to perform....
Role-Based Access Control
An authorization model that grants permissions according to predefined roles rather than individual users. It shows up in application security, identity,...
Row-Level Security
A database feature (notably in PostgreSQL) that enforces access policies on individual rows within a table, so different users or roles only see and modify the...

Related Topics