Security & GRC · Visual Explainer
AAA — Authentication, Authorization, Accounting
The concept
Three questions in order. Authentication proves identity — who are you? Authorization decides access — what may you do? Accounting records every action for audit — what did you do? Most security failures are one of the three done badly.
Key distinctions
| Term | What it means |
|---|---|
| Authentication | Something you know, have, or are. MFA means two different categories — two passwords is not MFA. |
| Authorization | RBAC and least privilege — permissions attach to roles, identities get roles, and explicit-deny wins. |
| Accounting | auditd, CloudTrail, session logs shipped to the SIEM — the dry one that saves you, because without it there is no investigation. |
| The distinction | Authentication failure lets the wrong person in; authorization failure lets the right person do the wrong thing. Most insider incidents are authorization. |
Why it matters in practice
Every access decision and every audit finding maps to one of these three A's. Naming which one failed is the fastest route to the right fix.