approved authorization
163522·updated Aug 30, 2026A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or p
Source
Enforce approved authorizations forthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- AC-3: Access Enforcement - CSF Tools
- Date updated: May 14, 2024 Withdrawn NIST Technical Series Publication
- Date updated: May 14, 2024 Withdrawn NIST Technical Series Publication
- authorize processing
- Assessing Security Requirements for Controlled Unclassified Information
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A set of formally sanctioned access rights, privileges, or permissions — validated through an organization's defined approval process (e.g., by an account manager, security officer, or authorizing official) — that constrain what subjects (users, processes, or systems) may do with objects (data, resources, or system functions). Authorization in this sense means "access privileges granted to a user, program, or process," and the modifier *approved* distinguishes permissions that have been explicitly reviewed and sanctioned from permissions that are merely present or default. In standards such as NIST SP 800-53 AC-3, the phrase appears as the direct object of *enforce*: systems and mechanisms must give effect to these sanctioned rights governing access between active subjects and passive objects, applied both at the system level and at the application and service level. The expression also appears in information-flow contexts — e.g., controlling the flow of CUI in accordance with approved authorizations, or enforcing approved authorizations for controlling the flow of information within and between connected systems — showing that the term covers any access decision that has been form
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- approved authorizations
- possessive
- approved authorization's
- pluralpossessive
- approved authorizations'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or pDR-088 backfill from the noun definition column