Authorization

The process of determining what resources a user (or system) is allowed to access after their identity has been verified through authentication. If authentication answers the question "Are you really Alice?", authorization answers "What is Alice allowed to do?"

‍

For example, after logging in (authenticating), Alice may be authorized to view certain reports but not modify them, or she may have access to the sales database but not the payroll system. Authorization works by checking permissions - typically based on roles, groups, or explicit rules - and enforcing those at the system level.

‍

In practice, authorization controls are what prevent users from accessing data they shouldn't see or taking actions they're not permitted to perform. These can be as simple as file read/write permissions or as complex as fine-grained policy engines in cloud environments.

‍

For small businesses, effective authorization often means using role-based access control (RBAC), minimizing admin privileges, and ensuring that access rights match each person's actual responsibilities. Good authorization protects your business by making sure even authenticated users can't wander into sensitive areas they don't need to be in.