Autorizacija

Autorizacija (authorization) is the process in information security of granting or denying a subject’s access to a resource or action based on verified identity and predefined policies. It determines what permissions a user or system has, such as reading a file, editing data, or performing administrative tasks, and enforces those permissions at the point of access.

Autorizacija follows authentication, which confirms who the subject is. Once identity is verified, authorization relies on rules, roles, attributes, or policies to decide allowed operations. Common models include discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC). The principle of least privilege—granting only the minimal rights necessary to perform a task—and separation of duties are key governance concepts in authorization.

Mechanisms and technologies used to implement autorizacija include access control lists, capability tokens, and policy-based decision systems. In modern systems, authorization decisions are often centralized through identity and access management (IAM) platforms. Standards and protocols such as OAuth 2.0, OpenID Connect, and SAML enable authorization across applications and services, frequently involving a policy decision point (PDP) and a policy enforcement point (PEP). Access tokens, refresh tokens, and attribute data convey permissions and context to resource servers.

Applications of autorizacija span operating systems, databases, APIs, cloud services, and enterprise networks. Effective authorization requires regular auditing, timely revocation of access, monitoring of privileged actions, and ongoing reviews to ensure compliance with organizational and regulatory requirements.