a set of rules established by an organization that specify how users can access resources on the system;
defines the implementation of the files concerning who or what can gain access to a system or network
organizational policy definition that defines how authorized users gain access to resources based on their role, job functions, and duties.