Authorization

Authorization is the process of determining what an authenticated user is permitted to access or do. Once a system knows who someone is, authorization decides what that person is allowed to reach: which pages they can view, which records they can edit, which actions they can trigger. It answers the question "what are you allowed to do?" and it is the gatekeeper that enforces the boundaries between an ordinary user, a paying subscriber, an editor, and an administrator. Authorization always follows authentication, because a system must first know who someone is before it can decide what they may do.

Mechanically, authorization is usually implemented through rules attached to users, often organized as roles or permissions. A common approach, role-based access control, assigns each user a role such as viewer, editor, or admin, and each role carries a defined set of permissions. When a user tries to perform an action, the system checks whether their role or permissions allow it and either grants or denies the request. More granular systems attach permissions to specific resources, so a user might be allowed to edit only the documents they created. These checks typically live in middleware or in the logic behind each protected endpoint, running on every sensitive request to make sure the user has not stepped beyond their bounds.

The word comes from "authorize," which traces back to the Latin "auctor," meaning originator or authority, the same root that gives us "author." To authorize is to grant permission, to give something the backing of authority. In software, authorization is the act of formally granting or withholding permission to do a particular thing.

For a business, authorization matters because it protects sensitive data and critical actions from people who should not have access to them, even when those people are legitimate, logged-in users. A subscription site uses authorization to keep premium content behind a paywall. A company's internal tools use it to ensure that only finance staff can approve payments and only administrators can delete accounts. Getting this right prevents both external abuse and internal accidents or misuse, and it is often a legal and compliance requirement when handling personal or regulated data. Poor authorization can expose private records or hand ordinary users powers they should never have.

The nuances and common mistakes are significant. A frequent and dangerous error is checking permissions only in the user interface, for example hiding a button, while leaving the underlying endpoint unprotected, so that anyone who sends the request directly can bypass the control. Another is overly broad roles that grant far more access than a user actually needs, which violates the principle of least privilege and widens the damage if an account is compromised. Confusing authorization with authentication is also common, yet they are distinct: one confirms identity, the other governs permissions. Authorization relates directly to authentication as the step that precedes it, to OAuth as a standard for delegating scoped access, and to JWTs that can carry a user's roles and claims. Enforced consistently on the server, authorization is what keeps a system's boundaries meaningful.