Authorization

Authorization is the process of evaluating whether a subject, already identified and usually authenticated, is permitted to perform a specific action on a target resource within a given context. In IAM, authorization decisions can apply to applications, APIs, databases, files, workflows, business objects, or infrastructure components. Authorization is not limited to a binary allow or deny outcome; mature systems also evaluate scope, conditions, obligations, temporal constraints, risk signals, and policy hierarchies. A robust authorization model defines who can do what, on which object, in which context, under which rules, and with which level of traceability.