DataTerminology.comNEW
Also known as: Access Management, Authorization Control
Policies and mechanisms that permit or deny requests to use resources, ensuring only authorized entities perform allowed actions.
DESCRIPTION
Access control enforces who or what can access a resource and which operations are permitted. It relies on robust authentication, authorization decisions, and enforcement points across applications, data stores, and infrastructure. Common models include DAC, MAC, RBAC, and ABAC, each balancing flexibility and security. Principles such as least privilege, need-to-know, and segregation of duties guide policy design. In modern architectures, zero trust emphasizes continuous verification instead of perimeter trust. Effective access control integrates with IAM, auditing, and secrets management, and is automated via policy-as-code.
ALTERNATIVE DEFINITIONS
NIST CSRC Glossary
The process of granting or denying specific requests for obtaining and using information and related information processing services.
Concise, process-focused definition used widely in U.S. federal guidance.
RFC 4949 Internet Security Glossary
A security service that limits and controls access to a system and the resources that the system controls.
Frames access control as a security service within the Internet security glossary.
Microsoft Learn
Azure role-based access control (RBAC) helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to.
Practical, cloud-oriented definition emphasizing role-based permissions and scope.
RELATED TERMS
Authentication Authorization Identity Management RBAC Least Privilege Segregation of Duties Audit Logging Zero Trust Data Encryption
COMPETING TERMS
Discretionary Access Control Mandatory Access Control Attribute-Based Access Control
RELATIONS
- Narrower: Attribute-Based Access Control Authorization Discretionary Access Control Fine-Grained Access Control Mandatory Access Control Policy-Based Access Control Unified Data Access Control
KNOWLEDGE AREAS
Data Security Software Engineering Infrastructure Cloud Data Management
TARGET AUDIENCE
Data Engineer Software Developer DevOps Engineer Cloud Architect Data Architect Chief Information Officer MLOps Engineer AI Engineer
EXTERNAL SOURCES
- Wikipedia - Access control
- NIST - Access control control family (AC)
- OWASP - Best practices and pitfalls
- Microsoft - RBAC in Azure overview
- Google Cloud - IAM overview for GCP
TOP QUESTIONS
What models are used for Access Control?
Common models include discretionary (DAC), mandatory (MAC), role-based (RBAC), and attribute-based (ABAC). Selection depends on security requirements, complexity, and change frequency.
Category: Overview
How does Access Control relate to Zero Trust?
Zero Trust applies continuous, context-aware access control. It avoids implicit trust from network location and enforces least privilege across workloads.
Category: Example
What are common Access Control mistakes?
Overprivileged roles, hard-coded checks, missing deny-by-default, and inconsistent enforcement across services are frequent errors. Poor logging hampers investigations.
Category: Mistakes
How can Access Control be managed at scale?
Use centralized IAM, groups, automation, and policy-as-code. Regular reviews and attestations keep privileges aligned with business needs.
Category: Management
What is a hot topic around Access Control today?
Fine-grained, attribute-based policies and just-in-time access are gaining adoption to reduce standing privileges.
Category: Topic
What’s the risk of weak Access Control for data platforms?
Data exfiltration, privilege escalation, and regulatory violations. Breaches often start from excessive permissions or missing revocation.
Category: Risks
How does Access Control differ from Authentication?
Authentication verifies identity; access control authorizes actions on resources. Both work together to enforce security.
Category: Misunderstanding
What is the role of RBAC versus ABAC in Access Control?
RBAC simplifies common patterns with roles; ABAC adds flexibility using attributes and context for dynamic decisions.
Category: Opinion
Where to start improving Access Control in the cloud?
Inventory permissions, adopt least privilege, apply managed identities, and refactor to role and attribute-based policies.
Category: Getting Started