What is Access Control

Definition

Access control is the security mechanism that determines which users and systems may perform which actions on which resources, enforcing authentication and authorisation so that data is reachable only by parties with a legitimate, granted need.

« Back to Glossary Index

Restricts data and actions to users with a verified, legitimate need
Enforces least privilege so accounts hold only the permissions they require
Provides an auditable record of who can do what across systems
Limits breach impact by containing what any single compromised account can reach

Glossary: Governance in Fabric

Real World Example

A hospital system uses role-based access control so a billing clerk can see invoice data but not clinical notes, while a physician sees the reverse, ensuring each role reaches only the data its job requires.

FAQs

What is the difference between authentication and authorisation?

Authentication verifies who a user is, while authorisation, the core of access control, decides what that verified user is allowed to do.

What is role-based access control?

RBAC grants permissions to roles rather than individuals, so users inherit access by being assigned roles, simplifying management.

What is the principle of least privilege?

Granting each user or system only the minimum permissions needed, reducing the damage a compromised account can cause.