Security technique that regulates who or what can view or use resources. Enforces policies determining access rights based on identity, role, or other attributes.