Security & Privacy
Authorization
AuthZ
Determining what an authenticated user, service, or agent is allowed to do.
Example
A signed-in employee can view reports but cannot change billing settings.
Why it matters
It limits what a recognized account or agent can actually do.
You'll hear it
“It can read the record, but it isn't allowed to change it.”
Can you control it?
Sometimes
Sometimes. Some products or workflows let you influence authorization, while others keep it fixed or manage it automatically. Check the settings and documentation for the tool you are using.
Common questions
- Does being signed in imply permission?
- No. Identity and allowed actions are separate checks.
- Can permission change after access was granted?
- Yes. A role change or removed approval can affect what should remain available.
- Should an AI decide its own permission from a written request?
- No. The surrounding system should enforce permissions independently of persuasive wording.