access control policy
163523·updated Aug 30, 2026A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.
Source
policies control access between active entities or subjects (i.e., users or system processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, domains) in organizational systems. Types of system access includethe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A security governance artifact — a set of high-level, authoritative rules — that specifies who (subjects: users, processes, roles) may access what (objects: files, devices, records, domains) under what conditions, and what operations are permitted once access is granted. Access control policies are "high-level requirements that specify how access is managed and who may access information under what circumstances," and may pertain to resource usage within or across organizational units or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. The field uses the expression both at the organizational level — an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance — and at the technical/model level, where named paradigms (mandatory, discretionary, role-based, attribute-based) are each themselves a named type: mandatory access control is "an access control policy that is uniformly enforced across all subjects and objects within a system," and discretionary access control is "an access control policy that is enforced over all subjects and o
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- access control policies
- possessive
- access control policy's
- pluralpossessive
- access control policies'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.DR-088 backfill from the noun definition column