The act of determining whether a user or application has the right to conduct particular activities in a system, relying on authentication to prove the identification of the user or application.