approved authorization
A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or p
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or pDR-088 backfill from the noun definition column