Authorization

Authorization is the process of determining which resources and actions are available to a user, application, device, or other entity after its identity has been established. The system checks assigned permissions and decides, for example, whether a user can open a file, modify a database record, perform an administrative operation, or access a specific API.

Authorization is one of the fundamental mechanisms of access control. It is used in operating systems, enterprise applications, databases, cloud platforms, network infrastructure, APIs, and other IT systems.

Authorization is closely related to authentication, but they are different processes. Authentication answers the question “Who are you?”, while authorization answers “What are you allowed to do?”

How Does Authorization Work?

In a typical scenario, authorization takes place after authentication. The system first establishes the user’s identity and then checks which permissions are associated with their account, role, or other attributes.

In simplified form, the process looks like this:

Identification → Authentication → Authorization → Access to a Resource

For example, two employees successfully sign in to the same corporate system. The first has a standard user role and can view documents belonging to their department. The second is an administrator who can also create accounts and change system settings. Both users have been authenticated, but authorization gives them different levels of access.

Each time a request is made to a protected resource, the application can evaluate the relevant access policies and allow or deny the requested operation.

What Is Authorization Based On?

A system can make access decisions based on various parameters. The specific mechanism depends on the access control model being used.

Common approaches include:

• RBAC (Role-Based Access Control) — permissions are assigned to roles, and users are assigned the appropriate roles;
• ABAC (Attribute-Based Access Control) — access decisions are based on attributes of the user, resource, action, and context;
• ACL (Access Control List) — an object has a list specifying which entities can access it and which operations they are permitted to perform;
• ReBAC (Relationship-Based Access Control) — permissions are determined by relationships between an entity and a resource.

For example, in RBAC, an employee can be assigned the Editor role, which allows them to create and modify content but not manage users. In ABAC, access can additionally depend on the employee’s department, document type, or other attributes.

Permissions and the Principle of Least Privilege

Authorization is based on permissions — specific rights to perform particular operations. These can include reading, creating, modifying, or deleting data, executing specific commands, managing settings, and performing other actions.

Authorization systems are often designed according to the Principle of Least Privilege (PoLP). A user or application should receive only the permissions required to perform its tasks.

For example, an application that only needs to read data from a specific storage resource should not be granted permission to delete that data. Limiting privileges reduces the potential impact if an account or software component is compromised.

Authorization in APIs and Web Applications

In web services, authorization is often implemented using tokens. After successful authentication, a system may issue a token that contains or represents information required to determine the client’s permitted level of access.

When accessing an API, the client sends the token, and the server checks whether the requested operation is allowed. Permissions can be determined using roles, scopes, claims, and access policies.

OAuth 2.0 is commonly used in this context as a framework for delegated authorization. It allows an application to obtain limited access to resources on behalf of a user, or in another supported context, without requiring the user to provide their password to the application.

Importantly, OAuth 2.0 is primarily an authorization framework. OpenID Connect (OIDC) is commonly used on top of OAuth 2.0 to provide user authentication.

Authorization in Cloud Infrastructure

In cloud environments, authorization is part of Identity and Access Management (IAM) systems. IAM is used to define permissions for users, groups, applications, service accounts, and other identities.

For example, an administrator can allow one employee only to view virtual machines, another to create and delete them, while granting an automated service access only to a specific storage resource.

Modern systems can also take into account the context of a request rather than relying solely on static permissions. Factors may include the device being used, network, time, risk level, or other conditions. This approach is used, among other scenarios, when implementing Zero Trust policies.

Authentication vs. Authorization: What Is the Difference?

These concepts are often used together but serve different purposes:

• Authentication verifies identity. A user proves that they are the legitimate owner of a particular account, for example by providing a password and a second authentication factor.
• Authorization operates on an already established identity and determines its permissions. The system decides which data and functions the user is allowed to access.

For example, an employee can sign in successfully with a password and a one-time code and still be unable to open the payroll records, because their role does not include that permission.

Successful authentication therefore does not mean unrestricted access. A user may sign in successfully but still be denied access to a resource for which they do not have the required permissions.

FAQ

🠔 Back to glossary