What is authorization and what are the possible access types?

Authorization decides which actions a subject may perform on an object; the access types are Create, Read, Update, Delete, Execute, or None.

Authorization = Managing permissions of subjects (users/services) accessing objects (resources)

Formula: permission = access(subject, object)

Access types (CRUD + Execute):

• Create - Add new resources
• Read - View resources
• Update - Modify existing resources
• Delete - Remove resources
• Execute - Run operations/functions
• None - No access allowed

Authorization indicates the actions a subject may perform on an object.