That is called authorization. Authentication can be done centrally. Authorization must be done on the resource you wish to protect. Each system must decide who gets access to what directory, web page, email folder, etc. Two things that can help ease the administration of that task are groups and attributes.
Groups are collections of identities.
By creating a group, it is possible to authorize access to more than one identity with a single rule. An authentication architecture can identify a particular identity as a member of a group but it cannot decide what access to give to that group. Attributes can be used in the authorization process by determining if an authenticated identity has a particular attribute that you require before allowing access to your resource. The authorization implications are very similar to groups. While groups have been around and implemented for decades, identity attributes are rather new.