access control policy

A security governance artifact — a set of high-level, authoritative rules — that specifies who (subjects: users, processes, roles) may access what (objects: files, devices, records, domains) under what conditions, and what operations are permitted once access is granted. Access control policies are "high-level requirements that specify how access is managed and who may access information under what circumstances," and may pertain to resource usage within or across organizational units or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. The field uses the expression both at the organizational level — an access control policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance — and at the technical/model level, where named paradigms (mandatory, discretionary, role-based, attribute-based) are each themselves a named type: mandatory access control is "an access control policy that is uniformly enforced across all subjects and objects within a system," and discretionary access control is "an access control policy that is enforced over all subjects and o

Advisory only. A term this product ships is defined by an authority document, not by a search result.