Method for managing authorizations on an arrangement having multiple computing systems, wherein a) an authentication token is generated by a first computing system and the authentication token, which comprises a unique identifier for identifying the authentication token and which is used to identify a user, is provided with a signature by the first computing system, b) at least one authorization token separate from the authentication token is generated by the first computing system, wherein the at least one authorization token represents an authorization and the unique identifier of the authentication token is stored in the authorization token and the at least one authorization token is signed by an authorization computing unit of the first computing system, c) the authentication token and the at least one authorization token are each transmitted to a user computing system, wherein each user computing system has assigned to it just one authentication token and any desired number of authorization tokens, d) a function on an application system, which is different from the user computing system, is enabled after the following steps have been performed: - receipt of the authentication token and authorization token from the user computing system, - verification as to whether the user computing system is authorized to use the authentication token, - verification as to whether the authentication token and the at least one authorization token are each provided with a valid signature, - verification as to whether the authentication token and the at least one authorization token are associated, - verification as to whether authorization information contained in the at least one authorization token authorizes enabling of the function on the application system. a) an authentication token is generated by a first computing system and the authentication token, which comprises a unique identifier for identifying the authentication token and which is used to identify a user, is provided with a signature by the first computing system, b) at least one authorization token separate from the authentication token is generated by the first computing system, wherein the at least one authorization token represents an authorization and the unique identifier of the authentication token is stored in the authorization token and the at least one authorization token is signed by an authorization computing unit of the first computing system, c) the authentication token and the at least one authorization token are each transmitted to a user computing system, wherein each user computing system has assigned to it just one authentication token and any desired number of authorization tokens, d) a function on an application system, which is different from the user computing system, is enabled after the following steps have been performed: - receipt of the authentication token and authorization token from the user computing system, - verification as to whether the user computing system is authorized to use the authentication token, - verification as to whether the authentication token and the at least one authorization token are each provided with a valid signature, - verification as to whether the authentication token and the at least one authorization token are associated, - verification as to whether authorization information contained in the at least one authorization token authorizes enabling of the function on the application system. - receipt of the authentication token and authorization token from the user computing system, - verification as to whether the user computing system is authorized to use the authentication token, - verification as to whether the authentication token and the at least one authorization token are each provided with a valid signature, - verification as to whether the authentication token and the at least one authorization token are associated, - verification as to whether authorization information contained in the at least one authorization token authorizes enabling of the function on the application system.