Security concept dealing with what a user is allowed to do — which actions and permissions are granted to them once identified. Contrasted with authentication. Travel analogy: a visa stamp is for authorization.