Authorization

Authentication confirms who is asking; authorization decides what they may do. Device designs are expected to limit each role to what it needs, which is the principle of least privilege.

the right or a permission that is granted to a system entity to access a system resource.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology