Set of rules that define who is granted access to a protected resource when, how, and under what conditions.