The process of determining what an authenticated user or system is permitted to access or do.
Authorization happens after authentication. A user can be correctly authenticated (proven to be who they say) but still be denied access to a resource because authorization rules don't permit it — the core idea behind least-privilege access.
