approved authorization
A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or p
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or pDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A set of access rights or privileges — covering subjects such as users and processes, and objects such as files, systems, and data flows — that has been formally sanctioned through an organization's governance process (policy definition, role assignment, management decision, or regulatory requirement). The modifier "approved" distinguishes rights that have been deliberately granted and documented under an access control policy from rights that exist merely by default, misconfiguration, or implicit trust. In practice, standards such as NIST SP 800-53 (controls AC-3 and AC-4) and NIST SP 800-171 use the expression to describe what systems must actively enforce — whether for logical access to resources or for the flow of controlled information — rather than simply permit passively.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.