Skip to content
    Flow-alerta.cab

    Authorization

    Web design & developmentAuthorisationEligibility checkAccess authorisation
    Editorially reviewed on: 2 sources
    Your reading view

    The short answer · 11 words

    In short

    Deciding whether an entity may use a particular resource or action.

    Flow-alerta.cab (2026): Authorization. https://flow-alerta.cab/en/glossar/authorization. Editorially reviewed on: 09 October 2026.

    How much detail would you like?

    Practical

    Central for APIs, web applications, automations and AI agents. Wrongly set rights can turn a harmless function into a significant risk.

    Example scenario: An employee account is allowed to read invoices, but only a person with an additional role is allowed to release payments.

    Granting permissions on the principle of least privileges, securing privileged actions separately and regularly reviewing rights.

    At a glance

    Core
    Authorization regulates rights: Who or what may perform which action on which resource? It must be distinguished from authentication, which verifies the identity. Authorization can be implemented via roles, attributes, policies or individual permissions.
    Use
    Central for APIs, web applications, automations and AI agents. Wrongly set rights can turn a harmless function into a significant risk.
    Example
    Example scenario: An employee account is allowed to read invoices, but only a person with an additional role is allowed to release payments.
    Limits
    Confuse authentication and authorization; set default rights too generously; lock only the interface, not the API; forget service accounts and agent rights.

    Questions about this term

    Is login authorization the same?

    No.

    Can an authenticated user still be rejected?

    Yes.

    Does authorization also apply to software agents?

    Yes, as soon as they access protected resources.

    All details and background

    Authorization regulates rights: Who or what may perform which action on which resource? It must be distinguished from authentication, which verifies the identity. Authorization can be implemented via roles, attributes, policies or individual permissions.

    ELI5 – Explained simply

    Authentication asks, “Who are you?” Authorization asks, “What can you do here?”

    Why it matters in practice

    Central for APIs, web applications, automations and AI agents. Wrongly set rights can turn a harmless function into a significant risk.

    Example

    Example scenario: An employee account is allowed to read invoices, but only a person with an additional role is allowed to release payments.

    Pitfalls and limits

    • Confuse authentication and authorization; set default rights too generously; lock only the interface, not the API; forget service accounts and agent rights.

    Origin & history

    Authorization is a basic concept of information security and access control. Modern systems implement them, among other things, with role- or attribute-based guidelines.

    Use in mid-sized companies

    • Granting permissions on the principle of least privileges, securing privileged actions separately and regularly reviewing rights.

    Related terms

    • RBAC
    • RBAC and ABAC
    • Least Privilege
    • OAuth 2.0

    Matching Flow-alerta service

    Websites & web applicationsWebsites & web applications: technical implementation and testing of a suitable web application.

    Matching tool / use case

    View use casesUse Case: Separate read, write and approval rights for an automated business process.

    Sources

    Quellenprüfung: 09.10.2026. Definition und dokumentierte Einordnung abgeglichen; Beispiele beschreiben mögliche Anwendungen.

    Editorially reviewed on:

    Next step

    Put knowledge into practice

    Discuss your projectView use cases