public:99_annexes:annex-b-terms-and-definitions:a:access_control

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
public:99_annexes:annex-b-terms-and-definitions:a:access_control [2026/09/12 17:42] – removed - external edit (Unknown date) 127.0.0.1public:99_annexes:annex-b-terms-and-definitions:a:access_control [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido
Line 1: Line 1:
 +====== Access Control ======
  
 +[[public:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]
 +
 +===== Discussion =====
 +
 +Access Control regulates interactions between a subject and a protected resource according to an applicable [[public:99_annexes:annex-b-terms-and-definitions:p:policy|Policy]].
 +
 +A subject includes a person, organisation, process, service, system, device, or [[public:99_annexes:annex-b-terms-and-definitions:n:node|Node]]. A resource includes information, an artifact, a service, an interface, a function, a system, a physical location, or another controlled object.
 +
 +An access-control decision evaluates the subject, requested action, protected resource, applicable policy, environmental conditions, and other relevant attributes. The decision grants, denies, limits, or terminates the requested access.
 +
 +[[public:99_annexes:annex-b-terms-and-definitions:a:authentication|Authentication]] commonly supplies verified identity or attribute information used in an access-control decision. Authentication remains distinct from Access Control. Authentication evaluates a claim. Access Control determines whether the applicable policy permits the requested interaction.
 +
 +===== Definition =====
 +
 +//process that grants, denies, restricts, or terminates access to a resource according to an applicable policy//
 +
 +===== Source =====
 +
 +Adapted from ISO/IEC 27000, Information security, cybersecurity and privacy protection — Vocabulary.
 +
 +===== Note =====
 +
 +Access Control includes administrative, physical, and technical controls.
 +
 +An access-control policy identifies the subjects, resources, permitted actions, prohibited actions, conditions, exceptions, decision authorities, and enforcement points within its scope.
 +
 +Access-control records support [[public:99_annexes:annex-b-terms-and-definitions:a:auditability|Auditability]], [[public:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]], and [[public:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] by recording access requests, decisions, enforcement actions, and relevant context.
 +
 +===== Example =====
 +
 +An access-control policy permits a Test Execution process to read an identified Credential from a secret store while denying direct access to the Credential value by test operators.
 +
 +----
 +
 +<WRAP centeralign>
 +© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
 +</WRAP>