Once a device has been authenticated, authorization limits its reach. A well-configured broker lets a device publish only to its own topic and subscribe only to its own command channel; an API lets a technician read devices in their region and nothing else; a cloud function may write to one table. These rules are expressed as policies or access control lists tied to identities in the device registry.
The principle is least privilege: grant exactly what the role needs. It contains damage when something is compromised, since a hijacked sensor that can only publish its own readings cannot command actuators or read the rest of the fleet. Coarse permissions are faster to set up and are the usual reason an incident spreads further than it should; zero trust designs push authorization to every request.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.