Authorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, citing CNSSI 4009-2022, defines it as "the decision to permit or deny a subject access to system objects (network, data, application, service, etc.)." Authentication (AuthN) comes first and answers who you are; authorization answers what you may do.
| Authentication (AuthN) | Authorization (AuthZ) | |
|---|---|---|
| Question | Who is this? | What may they do here, now? |
| NIST definition | "Verifying the identity of a user, process, or device" (FIPS 200) | The permit or deny decision above |
| Typical standards | Passwords, passkeys, OIDC, SAML | OAuth 2.0 scopes, AuthZEN, policy engines |
| Models | Factors and assurance levels (AAL) | RBAC, ABAC, ReBAC, fine-grained authorization |
| HTTP failure | 401 Unauthorized (really "unauthenticated") | 403 Forbidden |
The common confusion is OAuth. OAuth 2.0 is an authorization framework: an access token says what a client may do, not who the user is. OpenID Connect adds an ID token on top of OAuth to carry authentication. Using an OAuth access token as proof of login is a classic integration bug.
It matters because most breaches after initial access are authorization failures: the attacker authenticated as someone real and the system let that identity do too much. Strong authentication with standing admin rights still fails; least privilege, short-lived grants and decisions made per request, close to the resource, are the authorization side of the fix.
See also: authentication vs authorization, RBAC vs ABAC vs ReBAC, OAuth vs OIDC, best authorization tools, scope, privilege escalation
Related on Start with Identity
- GlossaryRow-Level Security (RLS)
Row-level security (RLS) is a database feature that decides which rows a query may read or change based on who is running it, enforced by the database itself ra
- GlossaryEthical Wall (Information Barrier)
An ethical wall, also called an information barrier or screen, is a set of controls that stops confidential information held by one group inside a firm from rea
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- BlogAmazon says 175 million customers now sign in with passkeys
Amazon reports more than 175 million customers have enabled passkeys, signing in six times faster, with passkeys now the default on mobile for anyone who has se
- BlogApache OFBiz 24.09.08 fixes a hard-coded JWT key, a password reset takeover and default-open REST auth
Apache OFBiz 24.09.08, announced November 4, fixes a batch of authentication flaws: a hard-coded JWT key giving unauthenticated admin access, a password reset f