An authorization check is a security control that verifies whether the caller is allowed to perform a specific action, such as launching a workflow, changing a policy, reading data, or executing a command. It is different from authentication: authentication asks who you are, while authorization asks what you may do. In secure systems, these checks should happen on the server side and before any sensitive operation is executed.
Missing or weak authorization checks are a common cause of serious breaches because they let attackers reach functions meant only for admins or trusted services. In control planes and orchestration platforms, one skipped check can expose the host that coordinates many downstream actions. Defenders look for explicit role-based rules, deny-by-default behavior, segmented privileges, and logs that reveal unauthorized requests or repeated failures. A strong authorization check is often the barrier that turns a dangerous request into a harmless rejection.