Authorization

Authorization decides whether a Security principal may perform a requested action on a protected object under a policy. authentication establishes an identity or source claim; authorization uses that claim together with permissions and context. Successfully proving an identity does not itself confer every operation.

For example, Alice may authenticate to a document service and be allowed to read one file but not overwrite it. The service must check the actual operation and object, not merely whether Alice logged in earlier. In filesystem traversal, permission to search each intervening directory is part of reaching a named file; knowing a pathname alone is insufficient.^[ref] Enforcement must occur at the boundary controlling the operation, because hiding an unavailable button in a graphical interface does not stop a separately formed request.