Knowledge Maxxing← Back to topic library
Dev MaxxingIntermediateIdentity and Access75 sec
Authorisation
Authorisation is determining what an already-identified user is permitted to do or access, after authentication has confirmed who they are.
Prerequisite: Authentication
What matters
A system can correctly authenticate a user yet still need separate rules to decide, for example, whether that specific user may view or edit a particular resource.
Example
After logging in successfully, a regular user might be authorised to view their own orders but not authorised to view another customer's orders.
Common misconception
Being correctly authenticated does not automatically grant authorisation to do everything in a system; the two checks serve different purposes.
Recall question
Why can a correctly authenticated user still be denied access to a specific action?
Keywords and related concepts
authorisationpermissionsaccess controlauthentication