access control policy
163523·updated Aug 30, 2026A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.
Source
policies control access between active entities or subjects (i.e., users or system processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. Types of system access includethe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- Access Control Policy and Implementation Guides | CSRC | CSRC
- Access Control Policy and Procedures
- Access Control Policy Testing (ACPT) | NIST
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A governance instrument — sitting above models and mechanisms in the access-control abstraction stack — that states the high-level rules an organization adopts to determine which subjects (users or processes) may perform which operations on which objects (files, devices, records, domains). NIST places it as one of three design abstractions — policies, models, and mechanisms — where the policy layer supplies "high-level requirements that specify how access is managed and who may access information under what circumstances." In practice it takes named forms — identity-based, role-based, or attribute-based — and is paired with enforcement mechanisms such as access-control lists, matrices, or cryptography to mediate access between users or processes and objects such as devices, files, records, and domains. Specifying one is treated as a non-trivial engineering problem in its own right, because a system's security is more often compromised by access-control policy misconfiguration than by failures of cryptographic primitives.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- access control policies
- possessive
- access control policy's
- pluralpossessive
- access control policies'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A governance instrument — sitting above models and mechanisms in the access-control abstraction stack — that states the high-level rules an organization adopts to determine which subjects (users or processes) may perform which operations on which objects (files, devices, records, domains). NIST places it as one of three design abstractions — policies, models, and mechanisms — where the policy layer supplies "high-level requirements that specify how access is managed and who may access information under what circumstances." In practice it takes named forms — identity-based, role-based, or attribute-based — and is paired with enforcement mechanisms such as access-control lists, matrices, or cryptography to mediate access between users or processes and objects such as devices, files, records, and domains. Specifying one is treated as a non-trivial engineering problem in its own right, because a system's security is more often compromised by access-control policy misconfiguration than by failures of cryptographic primitives.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.