access control policy

A governing statement or set of rules — situated at the policy layer of a security architecture, above implementation mechanisms — that defines which subjects (users, processes, or roles) are permitted to perform which operations on which objects (files, devices, records, domains, or other resources), and under what conditions. Organizations implementing access control systems distinguish three abstractions — policies, models, and mechanisms — with access control policies being the high-level requirements that specify how access is managed and who may access information under what circumstances. Policies may pertain to resource usage within or across organizational units, or may be based on need-to-know, competence, authority, obligation, or conflict-of-interest factors. In practice the term names a recognized category of security artifact that can be instantiated in several named paradigms: identity-based, role-based, and attribute-based policies are all enumerated types, each paired with a corresponding enforcement mechanism such as access control lists, matrices, or cryptography.