The mechanism that determines whether an authenticated user can access a particular resource.