Authorization

Definitions

1. Authorization is the process of determining what an authenticated user, service, or system is permitted to do, controlling access to resources and operations. While authentication answers 'Who are you?', authorization answers 'What are you allowed to do?' Common models include role-based access control (RBAC), where permissions attach to roles like Admin or Viewer; attribute-based access control (ABAC), which evaluates policies against user attributes; and access control lists (ACLs), which map permissions directly to resources. OAuth 2.0 scopes, AWS IAM policies, and Unix file permissions are all authorization mechanisms. Separating authentication from authorization lets each layer evolve independently and prevents scattered permission checks throughout the codebase.

   In plain English: Deciding what a logged-in user is allowed to see or do, like whether they can edit settings or only view them.

   Example: "Authentication tells us you are Alice; authorization tells us Alice can read invoices but not delete them."

Related Terms

• Privilege Escalation
• Capability
• IAM
• RBAC
• ABAC
• Access Control List
• EAP
• Fail-Closed
• Fail-Safe Default
• Grace Period
• Mandatory Access Control
• Port Knocking
• Data Lake Security
• Database Firewall
• Least Authority
• Management Plane Security
• Read Access
• Role Engineering
• Role Explosion
• Role Mapping
• Role Mining