approved authorization
163522·updated Aug 30, 2026A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or p
Source
Enforce approved authorizations forthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- AC-3: Access Enforcement | NIST 800-53 | UpGuard
- AC-3: Access Enforcement - CSF Tools
- ACCESS CONTROL POLICY AND PROCEDURES
- Date updated: May 14, 2024 Withdrawn NIST Technical Series Publication
- AC-3 - NIST 800-53 r5 Control Explorer - GRC Academy
- authorize processing
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A set of access rights or privileges — covering subjects such as users and processes, and objects such as files, systems, and data flows — that has been formally sanctioned through an organization's governance process (policy definition, role assignment, management decision, or regulatory requirement). The modifier "approved" distinguishes rights that have been deliberately granted and documented under an access control policy from rights that exist merely by default, misconfiguration, or implicit trust. In practice, standards such as NIST SP 800-53 (controls AC-3 and AC-4) and NIST SP 800-171 use the expression to describe what systems must actively enforce — whether for logical access to resources or for the flow of controlled information — rather than simply permit passively.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- approved authorizations
- possessive
- approved authorization's
- pluralpossessive
- approved authorizations'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A set of access permissions or privileges — granted to users, programs, or processes — that has been formally sanctioned through an organization's governance process (e.g., by a manager, system owner, or authorizing official) in accordance with applicable policy. What distinguishes it from authorization in general is the explicit "approved" qualifier: the rights must have passed through a defined review and approval workflow before they may be acted upon, tying individual entitlements back to a documented decision rather than informal or self-granted access. In practice, standards bodies such as NIST use the expression as the object of enforcement controls — systems must "enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies" — and equally as the basis for controlling information flows, as in controlling "the flow of CUI in accordance with approved authorizations." The expression is compositional in structure (adjective + noun), but it functions as a recurring technical phrase of art within NIST's access-control family, where authorization means "access privileges granted to a user, program, or pDR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A set of access rights or privileges — covering subjects such as users and processes, and objects such as files, systems, and data flows — that has been formally sanctioned through an organization's governance process (policy definition, role assignment, management decision, or regulatory requirement). The modifier "approved" distinguishes rights that have been deliberately granted and documented under an access control policy from rights that exist merely by default, misconfiguration, or implicit trust. In practice, standards such as NIST SP 800-53 (controls AC-3 and AC-4) and NIST SP 800-171 use the expression to describe what systems must actively enforce — whether for logical access to resources or for the flow of controlled information — rather than simply permit passively.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.