Authorisation
The next step after identifying and verifying the identity of an entity in the digital space, is to decide the privileges and permissions of the entity — which actions, locations and resources are allowed to be accessed by that entity.
For example: Once you enter an office building, the access cards decide the floor to which an employee has access to. There are certain softwares that require permission from the administrator before it can be downloaded on a system.
We can explain this with a simple analogy — when your family member / close friends are home, they can move everywhere around the house; When your office friends are home, they can sit in the living room while also eat with you in dining areas and garden space; But a gardener is allowed to work only in the garden area.
In short, the role of a user, verified through authentication, decides which parts of a system are accessible to that user.
Before we get into why authorisation is required, we must know that not all information or data is of the same privacy level.
Data can be categorised based on its privacy into:
Public : Can be viewed by all. For example, the about page of any organisation contains data which is accessible to everyone even without authenticating users.
Internal : This data is available to only the employees of an organisation. For example, announcement level information in the company portal. But these announcements are available to all employees of the organisation on organisations portal.
Confidential : This is the data available only to few authorised users. The exposure of this data can cause financial loss or harm, for example the salaries of employees, health data etc.
Restricted: The access to this type of data is extremely restricted and there are often regulations, laws and penalties around exposure of such data like Personally Identifiable Information,
Only once resources and information is classified can we start classifying them and control access to them.
Why is Authorisation Required?
To protect sensitive data: Data at a higher level in privacy requires more protection and strictest control in accessing it.
To maintain system integrity: It is important that only authorised users can alter / delete data and hence authorisation is a must to maintain integrity.
Making systems relevant to the user: By providing users with only the options and data relevant to their role, systems can offer a more user-friendly experience. For example as a blogger, users should have access and permission to write and edit their blogs only and not other users blogs, else app bceomes irrelevant.
Authorisation Models
Role-Based Access Control (RBAC)
In Role-Based Access Control, access is decided based on the role assigned to a user.
Get Nidhi S’s stories in your inbox
Join Medium for free to get updates from this writer.
Instead of giving permissions to each individual user, permissions are grouped into roles, and users are assigned those roles.
Like in a corporate office, Managers can access meeting rooms and approval systems, Employees can access workstations and internal tools While Visitors are allowed only in the waiting areas.
How is it implemented?
- A role is created (for example: Admin, Employee, Customer)
- Each role has predefined permissions
- Users inherit permissions based on the role they are assigned
- Once a user logs in and is authenticated, the system checks their role and allows access accordingly.
RBAC applies to organisations with clear job roles where system permissions do not change frequently and in applications that need simple and easy-to-manage access control.
Attribute-Based Access Control (ABAC)
In Attribute-Based Access Control, access is decided based on multiple attributes, not just roles.
These attributes can belong to:
- The user (department, designation, location)
- The resource (type of data, sensitivity level)
- The environment (time of access, device, network, location)
How is it implemented?
The system takes multiple attributes of entity into consideration before granting access like:
Who is the user?
What data are they trying to access?
From where and when are they accessing it?
Do all conditions allow access?
Only if all required conditions are met, access is granted.
For example: An employee (who is) may be allowed to access confidential data (what data) only during office hours (when) from a company device (which device) while connected to the organisation’s network (from where)
Even if the user has the right role, access can still be denied if all the conditions are not met.
Access is not based on identity alone, but on multiple conditions at the same time.
ABAC applies to large organisations with complex access requirements, where systems handle highly sensitive or regulated data and environments where access rules change frequently.
