Authorization control is the set of rules and checks that determines whether a particular action is allowed at the time it is requested. Unlike authentication, which verifies an identity, authorization evaluates what that identity or system may do, under which conditions, and within what limits.
In cyber security, authorization controls help prevent valid credentials or automated agents from performing actions outside their approved scope. They can check roles, resource permissions, transaction limits, eligibility, and whether an approval is still active or has expired or been revoked. In an agentic workflow, these checks should run in the trusted execution service against current policy-not rely on a stored memory or a prior successful action. Attackers may exploit missing or overly broad checks to access data or trigger operations they should not be permitted to perform.