Authorization checks are the controls that decide whether a specific user, service, or request is allowed to perform an action. They sit after authentication and before the action is executed. A system may know who made a request, but authorization checks decide what that identity can actually do, such as read data, change settings, or call a sensitive API.
In cyber security, weak or missing authorization checks are a common cause of privilege escalation and unauthorized access. Attackers look for endpoints that trust requests too much, especially in server-side components, integrations, and admin functions. If an application accepts a request without verifying ownership, role, or context, an unauthenticated or low-privilege user may reach functions that should be blocked. Defenders reduce this risk with strict allowlists, centralized access control, object-level checks, and testing that verifies every sensitive action is denied by default unless explicitly permitted.