authorization
termsecuritygovernance & risk
Deciding what an authenticated party may do - the check that runs on every request, not just at the door.
It is the harder half, because it has to be right per object rather than per person: a system knows who you are once, and must then decide about every record, endpoint and action separately. That is why broken access control is consistently the most common serious web defect - not because the concept is difficult, but because the check has to be repeated everywhere and any single place that forgets it is the whole failure.
Also known as: authz, rbac