Fine-grained authorization is access control that checks permissions at the level of individual objects, actions, or relationships, instead of giving broad access based only on a role or group. A system might allow a user to view one document, edit only certain fields, or access resources linked to their team or customer account.
This matters in cyber security because overly broad permissions are a common source of data exposure and privilege abuse. Fine-grained models help limit blast radius, support least privilege, and make sensitive workflows easier to audit. In practice, organizations implement it with policy engines, relationship-based authorization graphs, or policy-as-code systems that make allow/deny decisions before the application serves data or performs an action. Defenders use it to centralize rules, while attackers often try to exploit misconfigured policies, broken object-level checks, or stale relationships.