Usernames and passwords are a method of authentication, just as the police use finger prints. Authorization is a process of allowing or denying computing services based on characteristics of the authenticated individual. For example, one set of reserve room materials would be accessible to some people, but not others since some people are not members of a particular class. For example, after a person has been authenticated and authorized it is much easier to provide the person access to copyrighted materials with confidence, reimburse charge back fees, and monitor use of materials in the hopes of customizing services. Digital water marking is another security method.
Access control is a third.
Specifically, it has to do with the execution of operations which deliver information, or which change the state in a way that potentially affects future information delivery. Access control is said to be in effect if the store state permits any past action or future permission to be traced to proper authority, and if such permissions faithfully reflect an articulated policy. The store is said to have integrity if its state conforms to articulated consistency rules. A storage subsystem which has integrity and access control is said to be secure. In other words, access control is the process of exchanging data and information in a secure and authoritative manner once authentication has taken place.