MODULE 06 · AUTHENTICATION & SECURITY

Permission

A rule that controls whether a user, service, or application may access a resource or perform an action.

01 · What is it?

A permission is an authorization rule that allows or denies a specific operation on a resource.

It answers the question: “Is this caller allowed to do this action here?”

Simple Definition:
A permission says what a caller may do.

02 · Think of it like...

Think of a permission like a rule on an access card.

The card identifies the person entering a building.

The permission rule determines which doors that person may open.

A valid identity does not automatically grant access to every room.

Analogy:

Caller
Access Card
Permission Check
Allowed Action
Resource

03 · What does it do?

A permission turns an access policy into a decision the system can enforce.

Allow an Action

Permit a caller to read, create, update, delete, or execute.

Limit Scope

Restrict access to specific records, tools, amounts, or environments.

Support Least Privilege

Give only the access required for the task.

Block or Escalate

Stop a request or send a sensitive action for review.

04 · Where is it used?

Permissions are used wherever software needs to protect data, features, or external actions.

DataRecords and files

Read or change customer, order, or document data.

FeaturesProduct actions

Open an admin screen, export data, or change settings.

ToolsExternal services

Call an API, send a message, or run a job.

OperationsHigh-impact actions

Release payment, delete data, or deploy a change.

05 · Example

AI Finance Agent

  • Read invoiceALLOWED
  • Check ERPALLOWED
  • Flag mismatchALLOWED
  • Release paymentBLOCKED

The agent may have access to finance tools, but each proposed operation is checked against its permissions. A payment may also require a separate human approval.

Capability does not equal permission. Tool access does not mean every operation is allowed.

06 · How it connects

IdentityRolePermissionAccess CheckResource / Action

Authentication checks who the caller is. A role groups related permissions. Authorization evaluates the permission before access is granted.

07 · Do Not Confuse

Permission

A rule that allows or denies a specific action on a resource.

Authentication

The process of checking who or what the caller is.

Role

A named grouping of responsibilities and permissions.

Tool Access

A capability being available does not grant unlimited authority.

Human Approval

A person reviewing a selected action is a separate control.

Guardrail

A broader control that may inspect inputs, outputs, or actions.

08 · Topic Glossary

ENGLISH TERM中文SIMPLE ENGLISH中文小白理解
Permission权限A rule that allows or denies an action.决定某个操作能不能执行的规则。
Authorization授权Checking what a caller is allowed to do.检查调用方可以做什么。
Authentication身份验证Checking who or what the caller is.确认调用方是谁或是什么系统。
Role角色A named group of responsibilities and permissions.把一组职责和权限放在一起的名称。
Resource资源Data, a feature, or a system object being protected.需要被保护的数据、功能或系统对象。
Least Privilege最小权限Giving only the access required for a task.只给完成任务所必需的权限。
Access Check访问检查A decision about whether a requested operation may proceed.判断请求的操作是否可以继续执行。
Human Approval人工审批A person reviewing and approving a selected action.由人检查并批准某个具体操作。

09 · What to Remember

A permission is a rule that controls whether a caller may perform a specific action on a specific resource.

Use narrow permissions, check them in trusted application code, and add human approval where the action is high impact.

Core Flow:
Identity → Role → Permission → Access Check → Resource / Action

↑