What it means
Authorization evaluates a requested action against a policy. The decision usually depends on who or what is asking, the target resource, and the operation. Context may also matter, such as an approved time window or the relationship between a user and a record. Public access is an authorization choice too; some resources intentionally permit anonymous readers.
Authentication supplies identity evidence but does not replace these checks. Enforce authorization where the resource is served, not only in the browser interface. A user who cannot see an export button might still send an export request directly. Policies need both allowed cases and explicit boundaries that tests can exercise.
AN ILLUSTRATIVE SCENARIO
A healthcare referral service
A referral service allows clinic staff to view referrals assigned to their clinic. Two staff accounts can both sign in, but that does not entitle either to every referral. The application checks the clinic associated with the requested record as well as the user's permitted action. During testing, a developer uses synthetic referrals for two clinics and confirms that changing a record identifier does not reveal the other clinic's data.
Put it to work
- Describe access in terms of requester, action, and resource; include ownership or organizational boundaries rather than relying only on broad job titles.
- Enforce checks consistently on the server for each relevant request, including downloads, background operations, and alternate application interfaces.
- Create positive and negative tests with different users, resources, and roles; review the policy when responsibilities or data relationships change.
How to check your work
Use two test identities to demonstrate that each can perform its legitimate work and that cross-record or excessive actions are denied. Preserve the policy and representative test results together.
Connect the ideas
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
- Trust boundary
A place where identity, network, or data assumptions change and a fresh check is required.
- Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.