A system consisting of a machine tool and an authorization data providing device having a plurality of mobile data carriers for providing authorization data for executing operating functions of the machine tool, wherein the machine tool comprises - a plurality of operating functions, - a selecting device (113a - 113d) for selecting one or more operating functions by a user, - a receiving device for receiving authorization data specifying, which operating functions the user is allowed to execute on the machine tool, from the mobile data carrier, - a determining device for determining, which operating functions are allowed to be executed by the user, based on the received authorization data, - an access control device, which is arranged to control the access to the machine tool with respect to the selected at least one operating function and to allow access to the user only for those selected operating functions, to the execution of which the user is authorized according to the authorization data, and - an associating device for associating one or more operating functions with a plurality of authorization stages, wherein the authorization data stored on the mobile data carriers is invariable data, characterized in that authorization data of a master authorization stage is stored on one of the mobile data carriers, which authorizes associating one or more operating functions with authorization stages with lower rank stored on others of the mobile data carriers by means of the associating device, and the access control device and the associating device of the machine tool are arranged to allow variation of the association of operating functions with authorization stages only to a user with a mobile data carrier of the master authorization stage, and by a login device, which is arranged for logging in users such that a user with a mobile data carrier of the master authorization stage enters an enable code, which is encrypted by means of an encryption algorithm, in which a unique number of a mobile data carrier to be logged in and variable data relating to the operating function to be enabled of the user to be logged in are incorporated, and the determining device is arranged to determine the operating functions, to which the user to be logged in is authorized, by back-calculation of the encryption algorithm. - a plurality of operating functions, - a selecting device (113a - 113d) for selecting one or more operating functions by a user, - a receiving device for receiving authorization data specifying, which operating functions the user is allowed to execute on the machine tool, from the mobile data carrier, - a determining device for determining, which operating functions are allowed to be executed by the user, based on the received authorization data, - an access control device, which is arranged to control the access to the machine tool with respect to the selected at least one operating function and to allow access to the user only for those selected operating functions, to the execution of which the user is authorized according to the authorization data, and - an associating device for associating one or more operating functions with a plurality of authorization stages, wherein the authorization data stored on the mobile data carriers is invariable data, characterized in that authorization data of a master authorization stage is stored on one of the mobile data carriers, which authorizes associating one or more operating functions with authorization stages with lower rank stored on others of the mobile data carriers by means of the associating device, and the access control device and the associating device of the machine tool are arranged to allow variation of the association of operating functions with authorization stages only to a user with a mobile data carrier of the master authorization stage, and by a login device, which is arranged for logging in users such that a user with a mobile data carrier of the master authorization stage enters an enable code, which is encrypted by means of an encryption algorithm, in which a unique number of a mobile data carrier to be logged in and variable data relating to the operating function to be enabled of the user to be logged in are incorporated, and the determining device is arranged to determine the operating functions, to which the user to be logged in is authorized, by back-calculation of the encryption algorithm.