SECAI Core · phase 10 of 15
Authorization
The process of determining what rights and privileges a particular entity has.
The Explain card
- Plain English
- Authorization is determining what rights and privileges a particular entity has once it is authenticated. It answers "what are you allowed to do?"
- Example
- A finance analyst is logged into an AI assistant. Authorization rules let the assistant retrieve finance reports for them but deny requests for engineering source code, however cleverly the question is phrased. The model's tools check permissions on every call.
- Why it matters
- An LLM cannot be trusted to enforce permissions itself; it can be talked into anything. Authorization must live in the tools and data layer, where a prompt cannot rewrite it.
- Hook
- Through the door, but which rooms?
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
