Authorization
Authorization is the process of granting a user certain rights and permissions to access resources (files, data, functions) after successful authentication. It determines exactly what you are allowed to do in the system: read, edit, delete or only view.
Contents
What is authorization in simple words
Authorization is the process of checking a user's access rights after they have successfully passed authentication (confirmed their identity). If authentication answers the question “Who are you?”, then authorization answers the question “What are you allowed to do?”.
Imagine an office with different rooms. Authentication is when you show a badge at the entrance (you prove you are an employee). Authorization is when the system checks which rooms you can enter: accounting, the server room or only your own department. Even if you are an employee, you may have different rights.
Read about how identity verification happens in the article Authentication.
How authorization works
The authorization process includes three main stages:
- Identity verification (already passed): The user has successfully passed authentication.
- Access request: The user attempts to perform an action (open a file, send an email, change settings).
- Rights check: The system compares the requested action with the user's rights (role, group, access policies).
- Permission or denial: If the rights exist, the action is performed. If not, the user receives an access error.
The difference between authorization and authentication
| Characteristic | Authentication | Authorization |
|---|---|---|
| Main question | Who are you? | What are you allowed to do? |
| Action | Identity confirmation | Determination of access rights |
| Order | Always comes first | Comes after authentication |
| Methods | Passwords, codes, biometrics | Rights, roles, access levels |
| Example | Entering a login and password | The ability to edit a document or only read it |
Read about identity confirmation methods in the article Multi-factor authentication (MFA).
Authorization models
- RBAC (Role-Based Access Control): Access based on roles. Rights are assigned not to each user separately, but to roles (administrator, manager, employee). A user receives the rights of their role. The most popular model.
- ABAC (Attribute-Based Access Control): Access based on attributes. Rights depend on user characteristics (position, department, access time, geolocation). A more flexible, but complex model.
- DAC (Discretionary Access Control): Discretionary access control. The resource owner decides on their own who to give access to.
- MAC (Mandatory Access Control): Mandatory access control. Rights are assigned centrally (usually in government systems).
Read about access rights configuration in the article Access control.
Where authorization is used
- Websites and applications: Determining what content the user sees. An ordinary user sees their page, an administrator sees the control panel.
- Corporate systems: Access to documents, folders, programs. An accountant sees finances, a developer sees code.
- Cloud services: Delimitation of access to cloud storages, projects, databases.
- API: Checking access rights to endpoints (for example, a public API is available to everyone, a private one only to authorized users).
- Operating systems: Rights to read, write and execute files.
Example of authorization in life
You log in to a corporate portal:
- Identification: You enter your login (for example, ivanov).
- Authentication: You enter your password — the system checks that it really is you.
- Authorization: The system checks your role in Active Directory. If you are an “Administrator” — you see all sections. If an “Employee” — only your personal account and shared documents.
Read about corporate systems in the article ADIS.
Frequently asked questions
What is authorization in simple words?
Authorization is checking a user's rights after logging into the system. It answers the question “What are you allowed to do?”. For example, after logging into your email, you can read your own letters, but you cannot read others'. Read about how the login happens in the article Authentication.
What is the difference between authentication and authorization?
Authentication is “Who are you?” (identity verification, login by password). Authorization is “What are you allowed to do?” (rights verification, access to files and functions). Authentication always comes first, authorization second. Read more in the article Authentication.
Which authorization model is the most popular?
RBAC (Role-Based Access Control) — access based on roles. Rights are assigned to roles (administrator, manager, employee), not to each user separately. This is simple and convenient for management. Read about rights configuration in the article Access control.
What comes first: authorization or authentication?
Authentication always comes first — you prove who you are (enter a password). Only after that the system checks your rights (authorization). Without authentication, authorization is impossible. Read about the processes in the article Authentication.
What is RBAC in simple words?
RBAC (Role-Based Access Control) is an authorization model where access rights are assigned to roles, not to people. For example, all “Administrators” can delete files, while all “Employees” can only read them. If an employee is promoted to administrator, they automatically receive new rights. Read about access rights in the article Access control.
Other terms in «Information Security»
Was this information helpful?
Authorization
Authorization is the process of granting a user certain rights and permissions to access resources (files, data, functions) after successful authentication. It determines exactly what you are allowed to do in the system: read, edit, delete or only view.
All categories
Design and development of information systems
Design and development of automated information systems.
IT control and management
Unified protection system in geographically distributed data centers.
Protect your network today
Leave a request — our information security specialists will help you select, configure and integrate authorization into your infrastructure. We will protect your data from threats.