How authorization works
After identity is verified, the system evaluates a request against policy. The policy may reference the user's role, group membership, the sensitivity of the resource, or context such as the device and time of day. The result is a simple allow or deny decision.
Common approaches include role-based access control, attribute-based access control, and access control lists. Web and cloud services often use OAuth 2.0 scopes to express what an application may do on a user's behalf. Good designs enforce decisions centrally rather than leaving each application to improvise.
Why it matters for Canadian organizations
Many serious data exposures are not caused by a failed login but by users or applications having far more permission than they need. PIPEDA's safeguarding principle and Quebec's Law 25 both expect organizations to restrict internal access to personal information on a need-to-know basis.
Broken authorization is also a leading web application flaw, where one customer can read another customer's records by changing an identifier. For regulated organizations, including those following OSFI B-13, being able to show who is entitled to what, and why, is a routine audit expectation.
How to implement it
Define roles that match real job functions and assign permissions to roles rather than individuals. Apply least privilege by default, require approval for sensitive entitlements, and separate duties so no one person can complete a high-risk action alone.
Test authorization logic in applications, including attempts to access other users' data. Review entitlements on a schedule and remove stale ones. Privileged access management adds time-limited, logged elevation for administrators instead of permanent broad rights. Log denied and approved requests so unusual access patterns become visible quickly.
Frequently asked questions
What is the difference between authentication and authorization?
Authentication verifies identity, such as logging in with a password and a code. Authorization comes next and decides which resources and actions that verified identity can use. Both are needed, and a failure in either can lead to unauthorized access.
What is an example of authorization?
A finance employee can open payroll files but a marketing employee cannot, even though both have valid logins. Another example is a mobile app that is allowed to read your calendar but not send email on your behalf.
What is broken authorization?
Broken authorization means an application fails to properly check whether the requesting user may perform an action, so people can see or change data they should not. It is a common web application vulnerability and is usually found through testing.
Related service: Identity and access management