====== Access Control ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

Access Control regulates interactions between a subject and a protected resource according to an applicable [[dido:99_annexes:annex-b-terms-and-definitions:p:policy|Policy]].

A subject includes a person, organisation, process, service, system, device, or [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]]. A resource includes information, an artifact, a service, an interface, a function, a system, a physical location, or another controlled object.

An access-control decision evaluates the subject, requested action, protected resource, applicable policy, environmental conditions, and other relevant attributes. The decision grants, denies, limits, or terminates the requested access.

[[dido:99_annexes:annex-b-terms-and-definitions:a:authentication|Authentication]] commonly supplies verified identity or attribute information used in an access-control decision. Authentication remains distinct from Access Control. Authentication evaluates a claim. Access Control determines whether the applicable policy permits the requested interaction.

===== Definition =====

//process that grants, denies, restricts, or terminates access to a resource according to an applicable policy//

===== Source =====

Adapted from ISO/IEC 27000, Information security, cybersecurity and privacy protection — Vocabulary.

===== Note =====

Access Control includes administrative, physical, and technical controls.

An access-control policy identifies the subjects, resources, permitted actions, prohibited actions, conditions, exceptions, decision authorities, and enforcement points within its scope.

Access-control records support [[dido:99_annexes:annex-b-terms-and-definitions:a:auditability|Auditability]], [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]], and [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] by recording access requests, decisions, enforcement actions, and relevant context.

===== Example =====

An access-control policy permits a Test Execution process to read an identified Credential from a secret store while denying direct access to the Credential value by test operators.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>