A lightweight authorization framework that separates the concern of resource access from gathering information necessary to fulfill a request, like signing in with a username and password or enforcing an HTTPS connection.