1. A set of rules, part of a security policy, by which human users, or their representatives, are authenticated and by which access by these users to applications and other services and security objects is granted or denied. 2. The set of rules that define the conditions under which an access may take place. 3. A set of rules, part of a security policy, by which subjects are authorized and by which access by these subjects to objects is granted or denied.