matching of required access privileges with the privileges associated
with the user’s individual identity (as in discretionary access control),
the user’s role (as in role-based access control), the user’s clearance
(as in mandatory access control), the perceived level of risk the access