What it means
Authorisation is the process of deciding what an authenticated user or system is allowed to access or do. It answers the question "Now that we know who you are, what are you permitted to see and change?"
Real-world example
In a hospital, an AI assistant helps staff search clinical guidance and patient records. A nurse on the cardiology ward should see records of patients on that ward, but not the files of patients elsewhere. The assistant must enforce the same permission rules as the hospital's record system, both when retrieving documents and when generating answers.
Why it matters for AI adoption
AI assistants that search across many documents can accidentally reveal information that users would not normally be allowed to see, unless permissions are applied at the retrieval stage. Authorisation errors in AI systems can turn into data breaches through ordinary-looking questions.
Often confused with
Authentication verifies identity; authorisation determines permissions. Both are required, and they are checked at different points in a system.
Questions to ask
- Does the AI system respect the existing access rights of each user, including in search results?
- What can the AI system itself do on a user's behalf, and who approved those permissions?