The process of determining what an authenticated user or system is allowed to access or perform within a system.