Access management is the authentication of an identity that is asking for access to a particular resource, and access decisions or called authorization are simply the yes or no decision to grant that access.

This can be a tiered process, with access services that determine whether a user is authorized for any access on the network at all, and lower tiers of access that authenticate where the identity in question should be granted access to specific servers, drives, folders, files, data, systems and applications. Authorization for any given application or resource will be determined by the identity’s attributes, such as which group(s) it belongs to, it’s level in the organization or a specific role that was previously assigned.

As with authentication, the granting of authorization can occur in multiple tiers within the organization, for example, both as a centralized service and again locally for a given application or resource, although authenticating at the resource or service level is frowned upon as central authentication provides more consistent control.