authorizations

Authorization is the act of granting permission to perform actions or access resources. It follows authentication, the verification of identity, and together they enable access control in information systems and organizations. An authorization decision determines whether a principal, such as a user or service, is allowed to access a resource or execute an operation under defined policies.

In computing, authorization enforces permissions at various levels. Approaches include access control lists, capability-based schemes, and policy-based access control. Models such as role-based (RBAC), attribute-based (ABAC), and mandatory access control (MAC) specify how rights are assigned and evaluated. The principle of least privilege aims to grant minimal rights. Tokens or credentials—such as OAuth access tokens, API keys, or user sessions—often carry authorization information and may include scopes.

In legal and organizational contexts, authorization covers formal permissions, delegations of authority, and consent—for example powers of attorney, medical consent, or authorizations to disclose personal data under privacy laws.

In finance, payment authorization verifies that a transaction is valid and within limits, using card networks or bank systems; pre-authorizations may hold funds before settlement.

Security considerations include avoiding over-permission, ensuring timely revocation, and auditing permissions. Revocation, change of role, and employee departure require processes to maintain accuracy.

Standards and frameworks related to authorization include OAuth 2.0 for API access, OpenID Connect for user authentication and authorization, and policy languages such as XACML.