Authorization

Authorization ensures rights are associated with resources. When either a user, software or hardware requests a resource, authorization deals with defining the policy deciding whether access to that resource is allowed or not. Rights associated with each resource are called an Access Policy. A resource can be any of the following:

• Files;
• Any form of Data;
• Programs and parts of programs;
• Devices.

Not to be confused with Authentication. On the one hand, Authentication deals with identity, ensuring the subject (user or program) are who they claim to be. On the other hand, Authorization subsequently enforces the access policy associated with that same user or program. Those two steps together are part of Access Control, verifying consumers first and then authorizing. This control is often defined by a system administrator, and can be role-based in most modern systems. A common basis in authorization is the principle of least privilege: a consumer must only have access to what is necessary for the fulfillment of their task.