Unauthorization

Unauthorization is the state of lacking permission or the act of withdrawing permission to perform an action or access a resource. In information security and IT governance, it is a key counterpart to authorization and a fundamental aspect of access control.

Unauthorization can occur when a user or process attempts to act without the necessary rights, when credentials are missing or invalid, or when privileges have been revoked. It may arise during authentication (the verification of identity) or during authorization (permission checks). When authorization fails or is revoked, access attempts are denied and systems may return errors or trigger alerts.

Authorization determines whether an authenticated entity may perform specific actions. If authorization fails, access to data or functions is denied, and any attempted operation may be blocked or audited. Unauthorized access is the broader risk that arises when access controls are bypassed or misconfigured.

Common controls to prevent unauthorization include access control lists, role-based access control, and attribute-based access control, along with the principle of least privilege. Strong authentication, including multi-factor authentication, secure session handling, regular permission reviews, and comprehensive logging, also reduce the risk of unauthorized actions.

Unauthorization incidents can lead to data breaches, regulatory penalties, operational disruption, and reputational harm. Organizations typically define policies for who may access which resources, how permissions are granted and revoked, and how access is monitored and audited to minimize unauthorized activity.

Related topics include authentication, authorization, and access control.