Overview
Access control is the umbrella discipline that combines authentication, authorization, and the principle of least privilege into a working system for deciding who can do what to which resources. This lesson ties the module together.
Learning objectives
- Define access control and its core steps.
- Connect authentication, authorization, and accounting.
- Understand access control as an ongoing process.
Core concept
Access control is often described with the "AAA" model:
- Authentication — verify identity.
- Authorization — determine permitted actions.
- Accounting (auditing) — record what was done, so activity can be reviewed and attributed.
Together these ensure that only the right identities perform only permitted actions, and that there is a trustworthy record afterward. Accounting is easy to forget but vital: without logs, you cannot detect abuse or investigate incidents.
How it works
A complete access-control flow for a sensitive action:
- Identify & authenticate the requester.
- Authorize the specific action against the specific resource (server-side).
- Enforce least privilege so even authorized access is scoped tightly.
- Log (account for) the action for audit and detection.
- Review access periodically and revoke what is no longer needed.
Practical example
An employee opens a customer record: the system authenticates them, checks their role permits viewing that record (authorization), limits them to viewing rather than exporting (least privilege), and writes an audit log entry noting who viewed which record and when (accounting). If that employee later views records unrelated to their work, the logs reveal it during review.
Cybersecurity relevance
Access control is the backbone of protecting confidentiality and integrity. In cloud platforms it appears as IAM (Identity and Access Management); in databases as roles, grants, and Supabase-style row-level security (RLS). Well-designed access control is what keeps one user from reaching another user's data.
Common mistakes
- Implementing authentication and authorization but skipping logging, leaving no way to detect or investigate misuse.
- Setting access once and never reviewing it.
- Treating access control as a one-time config rather than a continuous process.
Key takeaways
- Access control combines authentication, authorization, and accounting (AAA), guided by least privilege.
- Logging is essential for detection, attribution, and investigation.
- Access control is an ongoing process of granting, scoping, auditing, and reviewing.
Check your understanding
- Name each part of the AAA model and what it contributes.
- Why is the "accounting/auditing" step important even when authentication and authorization are correct?