CyberGuard dictionary / Identity & Access
Authorization
The decision about which actions an authenticated identity is allowed to perform.
In simple terms
Authorization answers “What are you allowed to do?”
Technical explanation
Applications enforce permissions after establishing identity, ideally checking each sensitive request rather than trusting only the user interface.
Permissions should be enforced on the server for every protected object and action, including APIs and background jobs. A valid login or an unguessable identifier is insufficient evidence of permission.
Examples in practice
A customer can view their own invoices but cannot open another customer’s invoices.
A customer changes an invoice number in the address bar. The server checks ownership and returns a denial, then records the attempted cross-account access for investigation.
Why it matters
A successful login should never grant unrestricted access.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.