access control function

No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.

Increment 2: attested in 800-171r3 without a glossary definition.

A capability or software mechanism, within a system or application, whose specific role is to evaluate a subject's credentials or authorizations and enforce a policy decision — granting or denying the requested access to a resource, service, or operation. It is the operative unit that translates an access-control policy into a runtime enforcement action, distinct from the broader policy, model, or administrative process that surrounds it. In standards and legal instruments — including ITU-T security definitions and computer-crime law — the term names this enforcement function as a discrete, identifiable component: the part of a system that checks an identity code and removes or maintains restrictions on a protected use.

DR-088 backfill from the noun definition column

A procedural or technical capability — whether a software routine, an administrative role, or a system component — that implements and enforces an access control policy by evaluating requests from subjects against authorization rules and producing a permit or deny outcome. A security administration function specifies the authorization database that acts as an input to the access control function, meaning the phrase denotes the enforcement side of the access control pipeline, distinct from the policy-definition and audit sides. Authority documents such as NIST SP 800-53 use it in separation-of-duties contexts — for example, requiring that personnel who administer access control functions do not also administer audit functions — confirming that it names an identifiable, separable operational or technical role rather than the whole discipline of access control.

Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.