Authorization

Deciding what a verified user is allowed to do.

Once a person has logged in, authorization decides which accounts they can see, which settings they can change, and which actions, such as approving a payment, they can take. Two people can sign in to the same banking app and see completely different things.

Policy evaluation that grants or denies access to a resource after identity has been authenticated. A policy is a rule, such as "only the account owner can approve a transfer," and the system checks each request against its policies before it responds.

Systems commonly organize those policies in a few ways:

• Role-based access control (RBAC) assigns permissions to roles, such as customer, analyst, or administrator, and then assigns people to roles.
• Attribute-based access control (ABAC) evaluates attributes of the person, the resource, and the situation, such as department, account type, device, and time of day.
• Least privilege is the design principle of granting only the access a person needs to do their task.

Authorization sits next to two terms that are easy to mix up:

• Authentication confirms who the person is, while authorization decides what that person can do.
• Step-up authentication is an extra identity check that an authorization rule can require before a risky action goes through.