access control policy

No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.

A governance instrument — sitting above models and mechanisms in the access-control abstraction stack — that states the high-level rules an organization adopts to determine which subjects (users or processes) may perform which operations on which objects (files, devices, records, domains). NIST places it as one of three design abstractions — policies, models, and mechanisms — where the policy layer supplies "high-level requirements that specify how access is managed and who may access information under what circumstances." In practice it takes named forms — identity-based, role-based, or attribute-based — and is paired with enforcement mechanisms such as access-control lists, matrices, or cryptography to mediate access between users or processes and objects such as devices, files, records, and domains. Specifying one is treated as a non-trivial engineering problem in its own right, because a system's security is more often compromised by access-control policy misconfiguration than by failures of cryptographic primitives.