access control

The policies and technical mechanisms that determine who can view, edit, or delete specific data or systems. Access control models include Role-Based Access Control (RBAC), where permissions are assigned to roles rather than individuals, and Attribute-Based Access Control (ABAC), which evaluates contextual attributes. The principle of least privilege — granting only the minimum access needed to do a job — is the foundational guideline.

When you'd see it: Onboarding and offboarding processes, security audits, SaaS admin consoles, database configuration.

Why it matters: Most data breaches involve compromised credentials or excessive permissions. Access control is the last line of defense when authentication fails.

Common mistakes: Granting broad permissions for convenience during onboarding and never reviewing them. Most organizations accumulate far more access exposure than they realize.

Related RBAC, zero trust, IAM, principle of least privilege