"Permissions" and "policies" are related but distinct concepts used in access control, IT systems, organizations, and law — the exact meaning shifts a bit by context, but the core distinction is consistent.
Permissions (or rights) are specific, granular authorizations that determine what an individual user, role, or system entity is allowed to do with a particular resource. Examples include the ability to read, write, edit, delete, execute, or share a file; access a database table; or approve a transaction. Permissions are typically assigned directly to a user or, more commonly, to a role or group, and then that role is assigned to users. Permissions answer the question "Can this specific actor perform this specific action on this specific resource?"
Policies are broader sets of rules, conditions, or governing principles that define how, when, and under what circumstances permissions or rights should be granted, enforced, or restricted. A policy is a higher-level statement of intent or logic — for example, "all employees must have their account access reviewed every 90 days," "only devices with encryption enabled may access financial data," or "password must be changed every 60 days." Policies often combine multiple conditions (location, time, device type, risk level, role) and can dynamically grant or revoke permissions based on those conditions.
In practical terms:
- Permissions are the atomic building blocks — the actual yes/no grants of access to a resource or action.
- Policies are the rules engine or framework that decides which permissions apply, to whom, and under what conditions, and often govern how permissions are created, combined, or changed over time.
An analogy: think of permissions as individual keys to specific doors, while a policy is the set of rules determining who gets which keys, when those keys work (e.g., only during business hours), and how new keys are issued or revoked. In cloud platforms (like AWS IAM) or enterprise software (like SharePoint or Active Directory), you'll often see this distinction explicitly: individual permissions are assigned to roles, while policies are documents or configurations that bundle multiple permissions together and can also impose contextual conditions or restrictions on top of them.