AAA represents three distinct security processes:
Authentication ("Who are you?"): Verifies the identity of a user or system. Common methods include passwords, biometrics, smart cards, or multi-factor authentication. The system confirms you are who you claim to be.
Authorization ("What can you do?"): Determines what resources or actions an authenticated user is permitted to access. This is based on roles, permissions, and access control lists. Even after proving identity, users only get access to what they're authorized for.
Accounting/Auditing ("What did you do?"): Tracks and logs user activities for monitoring, billing, or forensic purposes. This creates an audit trail of who accessed what resources and when.
Example: When logging into a corporate network, you authenticate with username/password, get authorized access to specific files based on your role, and your activities are logged for security monitoring.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
The model's verdict: “”
The interactive diagram is below the answer - jump to diagram ↓
This answer is explained by a shared concept diagram - open →