Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Not to be confused with authentication.
Authorization is distinct from authentication but the two are often used together.
In Role Based Access Control (RBAC), an authorization decision may be dependent upon the identity of the user - whether the user is a member of a given role or group. This usually requires that the authorization authority know and understand the users identity and their membership in various groups or roles.
In Attribute Based Access Control (ABAC), an authorization decision may be based upon attributes provided by a trusted authority. These attributes may be indirectly associated with the user making the access request, but the authorization decision can be made even if the authorization authority does not know or recognize the identity of the user. (See SAML claims and assertions)
Authorization is sometimes abbreviated as "AuthZ", while authentication is "AuthN".
