# What is Access Control?

> Access control is the process of allowing or denying a subject’s request to use a resource, perform an action, or enter a protected environment.

- Canonical URL: https://yellowcube.eu/glossary/access-control/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

In digital systems, the subject may be a person, service, device, or process, while the resource may be data, an application, an interface, a network, or an administrative function.

An access-control design translates policy into enforceable decisions. It normally depends on identifying and authenticating the subject, determining what that subject is authorized to do, enforcing the result at a policy enforcement point, and recording enough context to review important decisions. Controls may use roles, attributes, relationships, rules, or combinations of these models.

### Key points

- **Policy inputs:** Identity, group or role, resource, requested operation, device state, location, time, risk, and other relevant attributes.
- **Decision and enforcement:** A policy engine can decide whether a request is permitted, but applications, gateways, operating systems, databases, and other enforcement points must apply that result correctly.
- **Lifecycle requirement:** Permissions and policy inputs need review when responsibilities, resources, trust relationships, or risks change.
- **Important limitation:** Access control cannot compensate for a falsely authenticated identity, an incorrect policy, an enforcement bypass, or permissions that are broader than the intended task.

### Related terms

[Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Authorization](<https://yellowcube.eu/glossary/authorization/>) · [Conditional access](<https://yellowcube.eu/glossary/conditional-access/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [Role-based access control (RBAC)](<https://yellowcube.eu/glossary/role-based-access-control/>)

### Sources

[NIST glossary: Access Control](https://csrc.nist.gov/glossary/term/access_control) · [NIST SP 800-53 Rev. 5: Access Control family](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.