Which concept describes determining what resources a user can access within a system?

Which concept describes determining what resources a user can access within a system?

• A. Authentication
• B. Authorization
• C. Permissions
• D. Identity verification

Answer: (B)

Authorization is the process of determining what resources a user can access within a system and what actions they can perform after their identity has been established. After you verify who someone is (authentication), the system applies policies—such as access control lists, roles, or attributes—to grant or deny access to resources. Permissions describe the specific rights assigned to an account or group (for example, read, write, or execute) and are the concrete privileges that authorization enforces. Identity verification (authentication) focuses on proving who the user is, not what they can do. In practice, a user logs in to prove their identity, and then authorization decides whether they may view or modify particular resources based on their permissions. This separation supports least-privilege access, ensuring users can only access what they truly need.

Authorization is the process of determining what resources a user can access within a system and what actions they can perform after their identity has been established. After you verify who someone is (authentication), the system applies policies—such as access control lists, roles, or attributes—to grant or deny access to resources. Permissions describe the specific rights assigned to an account or group (for example, read, write, or execute) and are the concrete privileges that authorization enforces. Identity verification (authentication) focuses on proving who the user is, not what they can do. In practice, a user logs in to prove their identity, and then authorization decides whether they may view or modify particular resources based on their permissions. This separation supports least-privilege access, ensuring users can only access what they truly need.