Access control is the collection of policies, mechanisms and processes used to determine which subjects are permitted to access particular resources and what actions they may perform on those resources. A subject can be a human user, service account, application, device or other identity, while a resource can be a file, database record, application function, network service, physical area or cloud resource.
Access control answers questions such as who may read a document, who may modify a database, which service may call an API and which administrator may change a configuration. It is distinct from authentication: authentication establishes or verifies an identity, whereas authorisation determines what that authenticated or otherwise identified subject is allowed to do. Access control is therefore a central component of information security and is used to enforce organisational and technical boundaries around data and systems.
Access-control decisions are commonly represented in terms of subjects, objects, actions and policies. A policy might state that a particular employee can read files belonging to a department but cannot delete them, or that a service can access one database table but not another. The system evaluates the relevant attributes and policy rules when an access request occurs. Access can be granted, denied or sometimes constrained by additional conditions such as time, device security state, network location or authentication strength.
The principle of complete mediation means that access requests should be checked consistently rather than assuming that a subject remains authorised indefinitely after an earlier decision. Effective access control also requires secure defaults so that resources are not accidentally exposed when a permission has not been explicitly configured.
Several access-control models are widely used. Discretionary access control, or DAC, allows resource owners or designated users to determine permissions, commonly through access-control lists. Mandatory access control, or MAC, uses centrally defined security labels and rules that users cannot freely override. Role-based access control, or RBAC, assigns permissions to roles such as administrator, editor or analyst and then assigns users to those roles.
Attribute-based access control, or ABAC, makes decisions using attributes of the subject, resource, action and environment, allowing more dynamic policies. Rule-based systems can impose additional conditions. Modern systems may combine these approaches, and cloud platforms often use policy languages that express permissions over resources, identities, actions and conditions.
Access-control mechanisms can operate at many technical layers. Operating systems control permissions on files, processes and system resources. Databases can restrict access to schemas, tables, rows or columns. Web applications can control which authenticated users may view or modify records. Network devices can filter traffic according to addresses, ports and protocols. Cloud platforms use identity and access-management systems to control access to infrastructure and services. Physical access systems control entry to buildings or restricted areas. The same user identity can therefore encounter several independent access-control layers, and security failures can occur when one layer grants access that another layer was not designed to permit. Defence in depth often depends on these controls being correctly configured and mutually consistent.
Access control is closely connected to the principle of least privilege, which states that subjects should receive only the permissions necessary for their legitimate functions. Least privilege reduces the potential damage caused by compromised accounts, malicious insiders and accidental misuse. Another related principle is separation of duties, in which sensitive activities are divided among multiple people or roles so that one person cannot unilaterally complete a high-risk process.
Privileged access management applies specialised controls to administrative accounts, including stronger authentication, approval processes, time-limited access and session monitoring. These principles transform access control from a static list of permissions into an ongoing governance process concerned with what access exists, why it exists, how long it should remain active and whether it remains appropriate.
Access-control failures are a common source of security incidents. Examples include an application allowing one user to access another user's record by changing an identifier in a URL, an incorrectly configured cloud storage resource exposing private files, excessive administrative privileges, forgotten accounts belonging to former employees, or an API failing to enforce authorisation on one endpoint. A particularly important distinction is between authentication and authorisation failures.
An application may correctly verify that a user is Alice but still incorrectly allow Alice to access Bob's information. This is an authorisation failure rather than an authentication failure. Testing therefore needs to verify not only that legitimate users can access intended resources but also that unauthorised users and roles are consistently denied access to resources outside their permissions.
Effective access control requires lifecycle management. Permissions should be provisioned when users or services need them, reviewed periodically, modified when responsibilities change and revoked when access is no longer justified. Organisations may use identity-governance systems, access reviews, automated provisioning and deprovisioning to manage this lifecycle. Service accounts and machine identities require equivalent attention because they can accumulate permissions over time without obvious human ownership. Logging access decisions can help detect misuse and investigate incidents. However, logging must be designed appropriately because excessive or incomplete logs can reduce their practical value. Access-control policies should also be understandable enough to audit and should reflect actual business requirements rather than simply accumulating permissions whenever an application reports that access is missing.
Access control is not synonymous with passwords, authentication, firewalls or permissions alone. Authentication identifies or verifies a subject; authorisation and access control determine permitted actions; accounting and auditing record relevant activity. Firewalls are one form of network access-control mechanism but cannot substitute for application-level authorisation. Encryption can protect information from unauthorised reading but does not itself determine who should be allowed to access a resource.
Good access control combines appropriate identity information, policy enforcement, least privilege, secure defaults, lifecycle management, monitoring and testing. Its ultimate function is to ensure that access to information and capabilities is granted according to defined rules rather than simply being available to anyone who can reach a system.
