Access Control
Also known as: Access Management
Definition
Access control is the process of evaluating a subject’s identity, attributes, or context against policy to determine whether access to a resource should be granted, limited, or denied. It is enforced through technical controls, administrative rules, or a combination of both.
Key Points
- Access control decides whether a request should be allowed.
- It depends on identity, authentication, and policy.
- Good access control supports least privilege and segmentation.
- Weak access control creates overexposure and lateral-movement risk.
- It is central to security and compliance.
Concept
In practice, access control sits between authentication and resource use. A user, device, or process proves identity, the system evaluates policy, and the request is allowed or blocked accordingly. That policy may depend on role, location, device posture, time, network segment, or risk level.
Access control is a foundational security mechanism because it reduces the number of paths into sensitive systems. It is also a compliance tool, because regulations often require proof that access is limited and auditable.
Explainer
The main challenge in access control is complexity. As environments grow, policies multiply, exceptions appear, and access models become harder to reason about. If the rules are too coarse, too many people or systems get access; if they are too strict, operations slow down and workarounds emerge.
A second limitation is drift. Access that was appropriate at onboarding may no longer be appropriate months later, especially in distributed or contractor-heavy environments. Without review and revocation processes, privilege accumulates and the control model weakens over time.
Across ConnectedEarth sectors, access control is essential in enterprise, industrial, government, telecommunications, and remote-operations environments. It is the practical boundary between authorized use and unnecessary exposure.