Authorization
The access-control decision that determines which actions an identified principal is permitted to perform on a resource.
Authentication establishes or verifies who a principal is; authorization decides what that principal may do. The decision can depend on roles, attributes, policy, resource ownership, or a combination of these inputs.
Authorization is not equivalent to hiding a button in the user interface. Enforcement must be repeated at the service or data boundary that protects the resource, and a role or permission claim supplied by an untrusted client cannot be accepted on its own. Auditability also benefits from retaining the principal, resource, action, and policy context behind a decision.
Related: Role-Based Access Control, Attribute-Based Access Control, Authentication, Secure Software Engineering.