A security practice that restricts who can view, modify, or share data based on defined permissions, roles, and authentication requirements.
Access control ensures that only authorized users can access specific data. It operates on the principle of least privilege: users should have access only to the data they need to do their job, and no more. Access control systems typically combine authentication (verifying who you are) with authorization (determining what you are allowed to do).
Common access control models include role-based access control (RBAC), where permissions are assigned to roles rather than individuals, and attribute-based access control (ABAC), where access decisions are based on attributes of the user, data, and environment.
Example: A city's GIS system contains both public datasets and confidential infrastructure data. Access control ensures that the public can view open datasets through the portal, city staff can access internal datasets based on their department and role, and only authorized engineers can view sensitive infrastructure locations. Each user's access is determined by their role, not by individual permissions.