# Authorization

The process of deciding what resources and actions an already-authenticated user is allowed to access.

**Authorization[↗](/authorization)** is the process of deciding what resources an authenticated user, device, or program may access and what actions it may perform. In short, it answers "what are you allowed to do?", not who someone is, but what they are permitted to do.

It is important to separate authorization from authentication[↗](/authentication); the two are sequential but distinct steps. In an analogy: authentication confirms who entered the building ("you came through the door"), while authorization determines which rooms that person can enter and which cabinets they can open. Identity is verified first, then permissions are applied.

Permissions are usually defined by roles, groups, or rules (for example, role-based access control[↗](/access-control), RBAC). This is where the principle of least privilege[↗](/principle-of-least-privilege) comes in: each user is granted only the access needed to do their job. That way, even if an account is compromised, the attacker's reach and potential damage are limited from the start.