In digital systems, the subject may be a person, service, device, or process, while the resource may be data, an application, an interface, a network, or an administrative function.
An access-control design translates policy into enforceable decisions. It normally depends on identifying and authenticating the subject, determining what that subject is authorized to do, enforcing the result at a policy enforcement point, and recording enough context to review important decisions. Controls may use roles, attributes, relationships, rules, or combinations of these models.
Key points
Policy inputsIdentity, group or role, resource, requested operation, device state, location, time, risk, and other relevant attributes.
Decision and enforcementA policy engine can decide whether a request is permitted, but applications, gateways, operating systems, databases, and other enforcement points must apply that result correctly.
Lifecycle requirementPermissions and policy inputs need review when responsibilities, resources, trust relationships, or risks change.
Important limitationAccess control cannot compensate for a falsely authenticated identity, an incorrect policy, an enforcement bypass, or permissions that are broader than the intended task.