= Authorization
<Authorization> decides whether a <Security principal> may perform a requested action on a protected object under a policy. <authentication> establishes an identity or source claim; <authorization> uses that claim together with permissions and context. Successfully proving an identity does not itself confer every operation.
For example, Alice may authenticate to a document service and be allowed to read one <file> but not overwrite it. The service must check the actual operation and object, not merely whether Alice logged in earlier. In filesystem traversal, permission to search each intervening directory is part of reaching a named <file>; knowing a pathname alone is insufficient.<Path Resolution in the Linux man-pages project>[Step 2, directory search permission and Permission checking]{ref} Enforcement must occur at the boundary controlling the operation, because hiding an unavailable button in a graphical interface does not stop a separately formed request.
Back to article page
