Authorization

Authorization is the process of determining what a verified user is permitted to do — what resources they can access, what actions they can perform, and what data they can view or modify. Authorization happens after authentication: first the system confirms your identity, then it checks what permissions your identity has been granted.

Authorization is implemented through access control mechanisms like role-based access control (RBAC), where permissions are assigned based on job roles, or attribute-based access control (ABAC), where access decisions consider multiple factors like user role, time of day, location, and data sensitivity.