What is authorization?

Authorization is the process of determining access rights, answering the question: "What are you allowed to do?"

In simple terms: authorization decides which resources and actions a user has access to after logging in.

---

#Why authorization is needed

Even if a user has successfully authenticated, that does not mean they are allowed to do everything.

Authorization is needed to:

• separate access between users;
• protect the system's data and functions;
• implement roles and access policies.

---

#How authorization works

The sequence is always the same:

1. Authentication - who are you?
2. Authorization - what are you allowed to do?

There is no authorization without authentication.

---

#Examples of authorization

• a regular user can read data but not delete it;
• an administrator can change settings;
• a guest has minimal rights.

---

#Main approaches to authorization

#1. Role-based access control (RBAC)

Rights are assigned by role:

• user;
• administrator;
• operator.

The most common approach.

---

#2. Rule-based authorization

• access depends on conditions (time, IP, device).

Often used in corporate networks and Zero Trust.

---

#3. ACL (access control lists)

• it is specified precisely who has access to what.

---

#Which security properties it supports

• Confidentiality - access only to permitted data;
• Integrity - protection against unauthorized changes.

---

#How authorization differs from authentication

The classic comparison.

• Authentication is who you are
• Authorization is what you are allowed to do