Authorization (Dictionary Entry)

Contexts	Computer Science, IAM
Term	Authorization
Alternative Forms	To authorize VERB
Definitions	The granting of privileges that govern what an authority allows an entity (or its identity representation) to do. More precisely, we may distinguish: The act of granting the privilege (implicitly the outcome of a decision or policy rule) The privilege itself (the abstract idea of its legitimacy coming from a decision or policy) The physical representation of this privilege for example in a computer system The verification of the privilege, often just before the entity performs an action to assure that the action was approved by the authority (e.g. at run-time)
Related Terms	Authentication (Dictionary Entry) Capability (Dictionary Entry) Permission (Dictionary Entry) Privilege (Dictionary Entry) Security Domain (Dictionary Entry)

Quotes

Access privileges that are granted to an entity that convey an “official” sanction to perform a security function or activity.

(Barker, 2020, p. 7)

Authorization
When an account is created, it is often necessary to specify what the account can do, in the form of privileges. We use the term authorization for the granting of privileges that govern what an account is allowed to do.
When Alice creates her online account, the bank authorizes her account to access the application to view checking accounts. If she does not have a brokerage account at the bank, her account would not be authorized to access the bank’s stock trading application. Needless to say, her account would also not be authorized to view account information for the bank’s other customers! Alice’s authorization indicates the privileges her account has been granted. Authorization for an account is typically done at the time an account is created and may be updated over time.

(Wilson and Hingnikar, 2019, p. 12)

Authorization is the process of determining the privileges the user or system is entitled to once the identity is established. In the context of digital services, authorization usually follows the authentication step and is used to determine whether the user or service has the necessary privileges to perform certain operations—in other words, authorization is the process of enforcing policies.

(Mather et al., 2009, p. 77)

Authorisation – What the Identity can do, in a given instance, as a result of proving an assertion.

(Milgate, 2006 )

Authorize
To grant a principal access to certain information.

(Saltzer and Schroeder, 1975)

Quotes

Bibliography

See Also