Authorization
Authorization is the process of granting and controlling what an authenticated user is able to do. It is focused on permissions. When it comes to permissions, you should adopt three principles:
The least-privilege principle, which is about giving users only the minimum permissions they need to accomplish their objectives
The need-to-know principle, which is about only giving users access to what they absolutely need to do their jobs and perform their roles
The implicit-deny principle, which means everyone is prevented from doing everything unless they are explicitly allowed
If you are careless with authorization, your users could do something they should not (by accident or on purpose), resulting in risks associated with CIA. A cybercriminal could gain control of an account with more privileges than they should have and move vertically (within a system) or laterally (between systems) and exfiltrate data, which would compromise CIA. Therefore, it is imperative that you control exactly what each user can access by establishing policies and rules and adopting the least-privilege principle (only giving users minimum permissions they need to do their job), the need-to-know principle (only giving users access to what they need to know to do their job), and the implicit-deny principle (denying by default unless explicitly allowed).