What Are the Three Main Components of User Access Control?
Published 2026-11-06
TL;DR: User access control is usually built from three parts: identification, authentication, and authorization. For small businesses, that means knowing which account is involved, proving the person really is that user, and limiting what the account can do if it gets compromised.
Opening paragraph
Access management generally rests on three elements: identification, authentication, and authorization. This model also helps small firms determine who may enter business email and what actions they can take after logging in, which is very much in line with NIST SP 800-63B and the FTC’s cybersecurity basics for small businesses.
Identification
Identification is how a system knows which person is trying to sign in. Usually that is a username, email address, or some other account identifier.
For a small business, this matters because you first need to know which account may have been exposed. If you are checking a business email incident, the starting point is not “who knows the password,” it is “which account was actually being used.” That is the account you inspect for strange sign-ins, forwarding rules, or other weird little surprises.
Authentication
Authentication is how the system verifies the person is really that user. That usually means a password, multi-factor authentication, or both.
In a business-email-breach situation, this layer is the one that gets shaky when a password leaks. If the password is out in the wild, the system may still ask for it, but the trust part is gone. If you need a practical next step for that scenario, see What to do if your password has been leaked.
Authorization
Authorization is what the verified user is allowed to do. That might mean reading email, changing settings, or managing other accounts.
Limiting permissions helps reduce harm if an account is compromised. If someone gets into a regular mailbox, that is bad enough. If the same login can also change admin settings, now the problem has extra legs.
Worked example
Say an employee signs in to business email with their work email address. That identifies the account. Then they prove they are really that user with the required sign-in method, which authenticates them. After that, the system lets them read mail, but not change admin settings unless that permission was specifically granted.
That simple flow helps owners see where to check for exposure or over-broad access. If the account was identified correctly but the sign-in method was weak, authentication is the weak spot. If the person could do far more than their job needed, authorization is the thing to trim back.
How the three parts help after a breach check
For a small business owner without an IT team, the practical checklist is pretty simple: confirm which account was identified, whether authentication was strong enough, and whether authorization was too broad.
Use that to decide what to reset, review, or remove. If the wrong account was used, fix the account record. If the sign-in method was weak, strengthen or reset it. If access was broader than it should have been, cut it back before the next surprise guest shows up.
Related next step
If you need to turn this into action, the access-removal article helps translate the three components into real cleanup when an employee leaves or an account should no longer have access: What access rights should be removed when an employee leaves?.