## Authorization (AuthZ)

"What are you allowed to do?"
(AuthN happens first, then AuthZ).

### Models
1.  **DAC (Discretionary Access Control)**:
    *   The owner decides. (Windows/Linux file permissions).
    *   "I created this file, I let Bob read it."
2.  **MAC (Mandatory Access Control)**:
    *   The System decides based on labels. (Military).
    *   "User is SECRET. File is TOP SECRET. User cannot read."
3.  **RBAC (Role Based Access Control)**:
    *   Access based on job function. (Corporate).
    *   "Bob is in HR Group. HR Group can read Payroll." (Best for scaling).
4.  **ABAC (Attribute Based)**:
    *   "User can read file IF location=Office AND time=9am-5pm." (Zero Trust).