This content has been automatically translated from Ukrainian.
Authorization is the process during which a website, application, or other system determines what data and functions a specific user has the right to access.
In simpler terms, the system already knows who you are and now decides: what exactly you are allowed to see and do.
For example, after logging into an online bank, you can view your own accounts and perform transactions, but you do not have access to other clients' accounts. In a corporate service, a regular employee can view documents of their department, while an administrator can add users and change settings. These are the kinds of restrictions that authorization defines.
Authorization is not just logging into an account
In everyday language, authorization is often referred to as simply logging into a website: “log in with username and password.” This is a clear and very common usage, but from a technical point of view, the process consists of at least two parts.
First, authentication occurs — the system checks who is trying to log in. This can be done using a password, a one-time code, biometrics, a passkey, or another method of verification.
After that, authorization comes into play — the system checks what rights the already recognized user has.
The scheme can be reduced to two questions:
Authentication: “Who are you?”
Authorization: “What are you allowed to do?”
For example, the password helped confirm that the account belongs to you. This is authentication. And the ability to edit your own profile after logging in, but not someone else's, is the result of authorization.
How authorization works
After a successful login, the system associates the user with certain access rights. These may depend on the role, account type, organization settings, subscription, or specific permissions.
Conditionally, the site may know:
- this user can read a document;
- this user can edit it;
- this user can delete files;
- this user has access to the administrative panel;
- this user sees only their own data.
Therefore, two people can be successfully logged into the same service at the same time but have completely different capabilities.
Authorization applies not only to people. Rights can also be granted to programs, mobile applications, APIs, and other services that are allowed to perform certain actions on behalf of the user.
Example with a social network
You log into your account on a social network.
After logging in, you can edit your own posts, change profile settings, view private messages, and manage your photos.
At the same time, you cannot open another user's private correspondence or change their profile.
The system has already determined who you are, and authorization has set the boundaries of access.
Even within one account, there may be additional restrictions. For example, the owner of a company page can grant another person the right to post, but not allow them to change settings or manage other administrators.
Authorization in work services
The role of authorization is especially noticeable in corporate systems.
Imagine a service where an accountant, a manager, and a system administrator work. Each has their own account and can successfully log into the system.
But the rights differ.
The manager works with orders and clients. The accountant has access to accounts and financial documents. The administrator manages users and service settings.
If the rights are set correctly, the employee receives only the access they need for their work. This approach reduces the risk of accidental data deletion, information leakage, or access abuse.
What it means to "Allow access" to an application
Another common example of authorization arises when one service requests access to another.
For example, you connect a third-party application to your Google account. A list of permissions may appear on the screen:
- viewing email address;
- access to the calendar;
- reading files;
- creating or editing certain data.
By clicking “Allow,” the user grants the application specific rights.
This is one form of authorization: the third-party program does not necessarily receive your password. Instead, it gets permission to perform defined actions.
That is why, before confirming such a request, it is important to look not only at the name of the application but also at what specific rights it is requesting.
A calculator, for example, is unlikely to need access to your email or contacts. If a simple service requests significantly more permissions than necessary for its operation, it is a reason to hesitate before confirming.
Why authorization is important for security
A strong password protects the account from unauthorized access, but that is not enough. It is equally important to correctly determine what a user can do after logging in.
If any registered user received unrestricted access to the system, the very fact of password verification would make little sense.
Authorization creates boundaries between users, data, and functions.
For example, it should not allow:
- a regular user to open someone else's private data;
- an employee without the appropriate authority to change financial information;
- a third-party program to obtain more data than it was allowed;
- a user to perform administrative actions without the appropriate role.
One of the basic principles of information security is to grant users and programs only the minimum necessary rights.
If an application only needs to read the calendar, it does not need permission to delete events. If an employee needs to view a document, it is not necessary to give them the right to delete it.
What the user can do themselves
Most of the authorization mechanisms are configured by the service itself, but some rights are controlled by the user.
It is worth periodically checking which applications are connected to important accounts — Google, Microsoft, Apple, social networks, and other services.
If you no longer use an application, its access can be revoked.
It is also important to read permission requests carefully. Especially if the application wants to access mail, files, contacts, photos, calendar, or other private data.
Granting access to an application can often be done with a single click. But this permission may remain active long after you remember the application itself.
What happens after logging out of an account
After logging in, the site usually creates a session, which means you do not have to enter your password on every page.
While the session is active, the service remembers which user is working with it and applies the appropriate access rights to their actions.
When the user logs out of the account, such a session should end. That is why, on shared or someone else's devices, it is important not just to close the browser tab but to use the “Log out” button.
This is especially true for mail, banking services, work systems, and other accounts with sensitive data.
Authorization, authentication, and verification — in brief
These three terms often appear together, but they denote different processes.
Authentication confirms who you are.
Authorization determines what you are allowed to do.
Verification checks the authenticity of certain data — for example, an email address, phone number, or document.
Therefore, entering a password during login is primarily authentication. Access after logging in only to your own data is authorization. And an email with a link to confirm an email address is verification.
