authorized privilege
** A set of elevated access rights, permissions, or capabilities that have been formally granted to a user, role, or process by an authorizing entity within a defined access-control policy. The expression functions as the collective object of access-governance controls — particularly least privilege and separation of duties — which exist precisely because such rights, though legitimately held, remain a vector for insider abuse or insider threat if concentrated without checks. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. In practice, separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion — making "authorized privileges" the specific threat surface that controls such as role separation, audit logging of privileged-function execution, and periodic access reviews are designed to govern. **VERDICT:** COMPOSITIONAL The expression is not a defined term of art with its own glossary entry in NIST SP 800-53, NIST SP 800-171, or related authority documents. It is a t
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- ** A set of elevated access rights, permissions, or capabilities that have been formally granted to a user, role, or process by an authorizing entity within a defined access-control policy. The expression functions as the collective object of access-governance controls — particularly least privilege and separation of duties — which exist precisely because such rights, though legitimately held, remain a vector for insider abuse or insider threat if concentrated without checks. The principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions. In practice, separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion — making "authorized privileges" the specific threat surface that controls such as role separation, audit logging of privileged-function execution, and periodic access reviews are designed to govern. **VERDICT:** COMPOSITIONAL The expression is not a defined term of art with its own glossary entry in NIST SP 800-53, NIST SP 800-171, or related authority documents. It is a tDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A set of permissions, capabilities, or access rights formally granted by an organizational authority to a user, process, or role, scoped to what is necessary for that principal to perform assigned functions. It is distinguished from unauthorized or incidentally acquired access in that it reflects a deliberate policy decision — typically documented through access authorization processes, role definitions, or least-privilege analysis — about what elevated actions a given subject may legitimately take. In practice, standards bodies use the concept as a risk object: separation of duties addresses the potential for abuse of authorized privileges and helps to reduce the risk of malevolent activity without collusion (NIST SP 800-53 Rev. 5, AC-5), and the principle of least privilege is applied with the goal of authorized privileges no higher than necessary to accomplish required organizational missions or business functions (NIST SP 800-171 Rev. 2, control 3.1.5), meaning that "authorized privilege" names the bounded, sanctioned entitlement set that controls must constrain and audit rather than any specific privilege type.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.