What is Authorization? Definition and explanations

Authorisation determines what an already-authenticated identity is allowed to do: which data to read, which actions to trigger, which records to modify. It is evaluated on every request, server side, and never merely by hiding a button in the interface. Broken access control tops the OWASP Top 10 precisely because that check is so often skipped.