# Access Control

The set of policies and technical mechanisms that decide who or what may view or use a resource, such as a file, system, or network.

**Access control[↗](/access-control)** is the set of policies and technical mechanisms that determine who or what is allowed to view or use a particular resource, a file, an application, a physical room, or an entire network. It's a foundational security concept: even perfect encryption[↗](/encryption) or a strong firewall[↗](/firewall) doesn't help if the wrong people are simply granted access in the first place.

A common best practice is the principle of least privilege[↗](/principle-of-least-privilege), giving each user or system only the minimum access needed to do their job, and nothing more, since this limits the damage if any single account is ever compromised. Access control decisions are typically enforced through a combination of authentication[↗](/authentication) (proving who you are) and authorization[↗](/authorization) (defining what you're allowed to do once identified).