AuthZ

AuthZ, short for authorization, is the process that determines whether a subject has permission to perform a given action on a resource. It follows authentication, which verifies identity, and is typically driven by policies and access-control rules. Authorization decisions depend on the subject’s identity or attributes, the resource’s attributes, the requested operation, and context such as time, location, or device state. Decisions are commonly binary (allow or deny), though they can include constraints or conditions.

Common models include RBAC (role-based access control), which assigns permissions by role; ABAC (attribute-based access control), which uses attributes of the subject, resource, and environment; DAC (discretionary access control), where resource owners grant access; and MAC (mandatory access control), which uses centralized labeling. Mechanisms to enforce these models include access control lists, capability-based access, and policy-based engines. In modern systems, policy decision points evaluate policies and produce permit or deny results, while policy enforcement points enforce those decisions at runtime.

Standards and languages used to express authorization policies include XACML, ALFA, and the Rego language used by the Open Policy Agent. Common implementations span operating systems, databases, API gateways, and cloud identity and access management. In web and API contexts, OAuth 2.0 provides a framework for delegated authorization, using scopes and access tokens to grant limited access to resources.