# What is Authorization?

> Authorization is the process or decision that determines whether a subject may perform a requested action on a resource.

- Canonical URL: https://yellowcube.eu/glossary/authorization/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It evaluates the subject, resource, operation, and applicable policy, often using roles, attributes, relationships, ownership, risk, or environmental context. The outcome may allow, deny, or constrain the request, and it may be re-evaluated as conditions change.

Authorization can occur after authentication, but the two functions are independent. A service may authenticate a workload yet grant it only a narrow API operation; a public service may authorize limited anonymous access without identifying a person. Sound design evaluates effective permissions at the resource and prevents one component from silently expanding a decision made elsewhere.

### Key points

- **Decision inputs:** Subject attributes, resource sensitivity, requested operation, policy, delegation, device or session context, and current risk signals.
- **Possible scope:** A whole resource, particular records or fields, defined actions, time windows, transaction limits, or combinations of these constraints.
- **Ongoing governance:** Owners should review grants, inherited permissions, role composition, exceptions, and actual use, then remove access when the need ends.
- **Important limitation:** A correct authorization decision has no effect if an application fails to enforce it consistently, trusts user-controlled inputs, or exposes an alternate path around the check.

### Related terms

[Access control](<https://yellowcube.eu/glossary/access-control/>) · [Conditional access](<https://yellowcube.eu/glossary/conditional-access/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [Role-based access control (RBAC)](<https://yellowcube.eu/glossary/role-based-access-control/>) · [OAuth 2.0](<https://yellowcube.eu/glossary/oauth-2-0/>)

### Sources

[NIST glossary: Authorization](https://csrc.nist.gov/glossary/term/authorization) · [NIST SP 800-162: Attribute-Based Access Control](https://csrc.nist.gov/pubs/sp/800/162/upd2/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.