01 · What is it?
Authorization evaluates an identity, a requested action, and a resource against access rules.
The result is an access decision: allow, deny, or require additional review.
MODULE 06 · AUTHENTICATION & SECURITY
Authorization
Authorization is the process of deciding what an authenticated user or system is allowed to access or do.
02 · Think of it like...
Think of authorization like checking which rooms a verified visitor may enter.
The entrance desk may know who the visitor is, but a badge or written rule still determines whether they can enter a particular room.
Verified Identity
Requested Action
Access Rules
Allow / Deny
03 · What does it do?
Authorization turns identity and policy into a decision that protects resources and actions.
Check the Resource
Identify the record, file, page, or service being requested.
Check the Action
Distinguish reading, creating, updating, deleting, or executing.
Apply Policy
Use roles, permissions, ownership, or other access rules.
Enforce the Decision
Allow the request, deny it, or send it for review.
04 · Where is it used?
Authorization is used whenever different identities need different levels of access.
Private DataRecord access
Allow people to see only the records they are permitted to view.
Team ToolsRole-based access
Give members, managers, and administrators different capabilities.
APIsAction scopes
Limit which endpoints or operations a client may call.
High-risk ActionsApproval rules
Require extra review before sensitive changes or transactions.
05 · Example
- A signed-in employee requests an invoice.
- The system checks the employee’s identity and team.
- A policy allows invoice viewing but not deletion.
- The system returns the invoice and records the decision.
The same person may be allowed to read one resource, edit another, and access neither a third. Authorization is specific to the action and resource.
Authorization should be checked on the server or trusted enforcement layer, not only hidden in the interface.
06 · How it connects
Authentication
Identity
Authorization Policy
Access Decision
Resource
Authentication supplies the identity; authorization uses it with context and policy to protect access.
07 · Do Not Confuse
Authorization
Decides what a verified identity may access or do.
Authentication
Verifies who the user or system is.
UI Visibility
Hides or shows controls but cannot replace server-side access enforcement.
A button being visible or hidden is not the authorization decision.
08 · Topic Glossary
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| Authorization | 授权 | Checking what an identity is allowed to do. | 检查某个身份可以执行哪些操作。 |
| Permission | 权限 | A rule that allows or denies a specific action. | 允许或拒绝某个具体操作的规则。 |
| Role | 角色 | A named group of permissions. | 一组被命名的权限集合。 |
| Policy | 策略 | Rules that describe access decisions. | 规定访问如何判断的一组规则。 |
| Resource | 资源 | Data, service, or object that may be accessed. | 可能被访问的数据、服务或对象。 |
| Scope | 范围 | The limited set of actions or resources covered by access. | 访问权覆盖的有限操作或资源范围。 |
| Least Privilege | 最小权限 | Giving only the access needed for a task. | 只提供完成任务所需的权限。 |
09 · What to Remember
Authorization answers “What may you do?” after the system has an identity to evaluate.
Protect each resource and action with explicit rules, and enforce those rules in a trusted layer.