DataTerminology.comNEW
Also known as: AuthZ
Determining permitted actions for an authenticated identity using policies, roles, or attributes.
DESCRIPTION
Authorization governs what an authenticated identity can do within a system by evaluating policies, roles, and attributes against requested actions on resources. It is enforced through access control decisions executed by policy engines or service layers. Common implementations include RBAC, ABAC, and policy-as-code frameworks. Strong authorization reduces risk through least privilege, segregation of duties, and contextual constraints. It integrates closely with IAM, APIs, and microservices. Authorization spans application, data, and infrastructure layers and must be audited for compliance.
ALTERNATIVE DEFINITIONS
Wikipedia
Authorization or authorisation is the function of specifying access rights/privileges to resources, which is related to information security and computer security in general and to access control in particular.
Emphasizes specification of access rights and linkage to access control.
Microsoft Learn
Authorization is the process of determining what permissions an authenticated identity has.
Clarifies authorization as subsequent to authentication and focused on permissions.
OWASP
Authorization is the process of verifying that a user has permission to perform an action or access a resource.
Stresses verification of permissions for specific actions or resources.
Cloudflare
Authorization is the process of determining a user’s permissions or access level.
Frames authorization as determining access level for users.
RELATED TERMS
Access Control RBAC Attribute-Based Access Control OAuth 2.0 JWT Identity Management Least Privilege Zero Trust Policy-Based Access Control
COMPETING TERMS
RELATIONS
- Broader: Access Control
KNOWLEDGE AREAS
Data Security Software Engineering Data Management Data Privacy & Compliance
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Software Developer DevOps Engineer Cloud Architect IT Manager
EXTERNAL SOURCES
- Wikipedia - Authorization
- NIST - Security controls including access enforcement
- IETF - OAuth 2.0 authorization framework specification
- AWS - IAM overview for authorization on AWS
- Microsoft - Azure RBAC overview and concepts
- Google Cloud - Google Cloud IAM overview
TOP QUESTIONS
What is Authorization and how does it differ from Authentication?
Authorization decides what an authenticated identity can do, while authentication verifies identity. You authenticate first, then authorize actions based on policies and roles.
Category: Misunderstanding
Why is Authorization critical in modern microservices?
It enforces least privilege across many services, preventing lateral movement. Centralized policy and service-level guards reduce risk and simplify compliance.
Category: Relevancy
What are common Authorization models used today?
Role-Based Access Control, Attribute-Based Access Control, and Policy-Based Access Control dominate. Many organizations combine RBAC with ABAC for contextual decisions.
Category: Overview
How is Authorization typically managed at scale?
Use IAM, centralized policy engines (e.g., OPA), and policy-as-code. Automate reviews and logs, and integrate with CI/CD to prevent drift.
Category: Management
What is a common mistake in Authorization design?
Hardcoding authorization logic in services. It complicates audits, increases drift, and hinders policy evolution.
Category: Mistakes
What risks arise from weak Authorization?
Privilege escalation and data exfiltration. Excessive permissions violate least privilege and regulatory expectations.
Category: Risk
How does Authorization relate to Zero Trust?
Zero Trust continuously authorizes each request with context, not just network location. Authorization is evaluated per transaction.
Category: Concept
What standards influence Authorization implementations?
OAuth 2.0, OIDC for delegated authorization, and NIST SP 800-53 control families guide policy and control design.
Category: Standards
How do you test Authorization effectively?
Use unit and integration tests for policy decisions, negative tests for denial cases, and policy simulators in CI/CD.
Category: Testing