Access Control
Access control is the broader security discipline that enforces authorization rules on access to resources, actions, and data.
Definition
Access control is the set of mechanisms, models, policies, and enforcement points used to ensure that subjects can access only the resources and actions they are permitted to use. It includes not only the authorization decision itself, but also the administrative processes that define permissions, the enforcement mechanisms that apply them, the review processes that validate them, and the audit traces that prove them. In practice, access control spans user interfaces, APIs, application services, databases, file systems, networks, and cloud control planes. Authorization is therefore a core decision function inside the broader access control domain.
Why it matters
Access control is the operational backbone of security enforcement. It is where policy, identity, business rules, and technical enforcement meet.
The Ariovis perspective
Ariovis separates governed entitlements, authentication and runtime authorization. When a decision depends on the user, resource, action and context, it should be made at the moment of use.
Common pitfalls
- Many organizations define access control only at application entry points and forget object-level, field-level, API-level, and downstream data-layer enforcement.
Standards and protocols
- NIST SP 800-162
- ISO/IEC 27001
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.