Authorization
Authorization determines what actions or resources an authenticated user is permitted to access.
“Permission given to a user or process to access resources.”
(Definition reproduced from the ISTQB Glossary. Copyright belongs to ISTQB.)
View the complete ISTQB GlossaryWhat is Authorization?
After authentication confirms identity, authorization applies access control rules to determine what operations a user, service, or process may perform within the system.
Access control: Permissions are assigned based on roles, policies, or privileges.
Role-based security: Many systems implement role-based access control (RBAC).
Testing focus: Verify that users can access only the functions and data they are authorized to use.
Real World Example
An online banking login flow is being reviewed after fraud analysts report repeated attempts to discover valid customer accounts.
The concern is not whether ordinary login works; it is how the system behaves when someone intentionally misuses it. Authorization points testing toward that hostile or risky behavior.
The tester probes rate limits, error messages, audit events, lockout behavior, and monitoring signals to see whether the system gives attackers useful feedback.
The team strengthens the controls because Authorization helps them test the product from the perspective of misuse, not only normal customer journeys.
Practice Questions
Question 1
Which issue MOST clearly indicates an authorization flaw?
Question 2
Which test MOST directly validates fine‑grained authorization in an API?
Test your knowledge with real ISTQB-style questions
You’ve learned Authorization. Test your understanding with topic-specific questions in our Mock Exams.