Software → Security
Authorization
The process of deciding what an authenticated identity is allowed to access or perform.
Where it fits
Authorization decides whether an authenticated actor may perform an action. It is central to APIs, web applications, business systems, and security engineering.
Mental model
Authorization answers: “Is this identity allowed to do this operation on this resource?”
Example
A user may read their own invoice but not another customer’s invoice. An admin may refund an order, while a support agent may only view it.
Common mistakes
- Checking permissions only in the UI.
- Assuming authentication implies permission.
- Forgetting object-level authorization.
Related concepts
Authentication, role-based access control, API, input validation.