access control function
A capability or software mechanism, within a system or application, whose specific role is to evaluate a subject's credentials or authorizations and enforce a policy decision — granting or denying the requested access to a resource, service, or operation. It is the operative unit that translates an access-control policy into a runtime enforcement action, distinct from the broader policy, model, or administrative process that surrounds it. In standards and legal instruments — including ITU-T security definitions and computer-crime law — the term names this enforcement function as a discrete, identifiable component: the part of a system that checks an identity code and removes or maintains restrictions on a protected use.
Senses
No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.
A procedural or technical capability — whether a software routine, an administrative role, or a system component — that implements and enforces an access control policy by evaluating requests from subjects against authorization rules and producing a permit or deny outcome. A security administration function specifies the authorization database that acts as an input to the access control function, meaning the phrase denotes the enforcement side of the access control pipeline, distinct from the policy-definition and audit sides. Authority documents such as NIST SP 800-53 use it in separation-of-duties contexts — for example, requiring that personnel who administer access control functions do not also administer audit functions — confirming that it names an identifiable, separable operational or technical role rather than the whole discipline of access control.
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- access control functions
- possessive
- access control function's
- pluralpossessive
- access control functions'