9Aug 2026

The three access control security services explained

Technician wiring UK office access control panel

The three fundamental access control security services are authentication, authorisation, and accounting, collectively known as the AAA triad. Together they form the backbone of logical access control in any network or system.

  • Authentication — verifies that a user or device is who they claim to be (think: proving your identity at the door).
  • Authorisation — determines what an authenticated identity is permitted to do or access (think: which rooms your badge actually opens).
  • Accounting — records what was done, when, and for how long (think: the logbook that tracks every movement through the building).

Every serious access control security system runs these three services in sequence. Skip one, and the whole model breaks down.

Key takeaways

Authentication, authorisation, and accounting operate in strict sequence, and removing any one of them leaves a gap that neither of the other two can fill.

Point Details
The AAA triad Authentication verifies identity; authorisation sets permissions; accounting records actions.
Sequence is critical Each service depends on the previous one; authorisation cannot function without prior authentication.
MFA is the baseline Multi-factor authentication is the NCSC-recommended standard for all administrative and internet-facing accounts.
Log everything Capture logins, failures, privilege changes, and session data; store logs centrally and test their integrity.
Review roles regularly Quarterly role audits prevent privilege creep, the most common cause of authorisation failures.

Table of Contents

How the three services fit together and why the order matters

The sequence runs: identification → authentication → authorisation → accounting. Each step depends on the one before it, which is where most failures originate.

Identification is simply a claim: “I am Alice.” Authentication is the proof: Alice presents a password, a token, or a fingerprint. Only after that proof passes does authorisation kick in to decide what Alice can actually do. Accounting then runs silently in the background, logging every action she takes.

The building analogy makes this concrete. You present your ID badge at the entrance (authentication). The door system checks whether your badge permits access to the server room (authorisation). The access log records that you entered at 14:32 and left at 14:47 (accounting). Remove any one layer and you either let the wrong people in, give them too much freedom once inside, or have no record of what happened.

Pro Tip: The most common failure point is not a broken authentication system — it is authorisation drift. Users accumulate permissions over time as roles change, and nobody removes the old ones. Audit role assignments quarterly, not just when someone leaves.

Authentication: how systems verify who you are

Authentication answers one question: is this person or device genuinely who they say they are? It is distinct from identification, which is just the claim. Authentication is the proof of identity.

Common authentication methods include:

  • Passwords and PINs — the most widespread method, though weakest when used alone.
  • Multi-factor authentication (MFA) — combines something you know (password), something you have (token or phone), and something you are (biometric). MFA is now the baseline expectation in UK enterprise environments.
  • Biometrics — fingerprint, facial recognition, or iris scanning; common in physical access control and increasingly in mobile device management.
  • Digital certificates and tokens — used in VPNs, device management platforms, and machine-to-machine authentication where a human is not present.

Where each method tends to appear: passwords and MFA cover web applications and VPN gateways; certificates handle device enrolment in enterprise mobility management tools; biometrics appear at physical entry points and on mobile endpoints.

Pro Tip: The NCSC’s guidance on multi-factor authentication recommends MFA for all administrative accounts and any system exposed to the internet. If you are deploying in a UK public sector or critical infrastructure context, MFA on privileged accounts is not optional — it is an audit expectation.

Credential storage matters as much as the method itself. Passwords must be hashed using a modern algorithm (bcrypt or Argon2, not MD5). Fallback methods — security questions, backup codes — need the same scrutiny as the primary method, because attackers target the weakest path.

Authorisation: deciding what an authenticated user may do

Once identity is confirmed, authorisation determines the boundaries. As Fortinet’s AAA security overview explains, authorisation grants permissions and defines what resources an authenticated user can reach and what actions they can perform.

Three models dominate real deployments:

Role-Based Access Control (RBAC) assigns permissions to roles rather than individuals. An accounts payable clerk gets read and write access to the finance system; the same person has no access to HR records. Clean, auditable, and the most common model in UK enterprise.

Attribute-Based Access Control (ABAC) is more granular. Permissions depend on attributes: the user’s department, the sensitivity of the data, the time of day, or the device being used. A contractor working remotely at 02:00 on an unmanaged laptop might be denied access that the same contractor would receive during business hours on a managed device.

Access Control Lists (ACLs) operate at the resource level, specifying exactly which users or groups can read, write, or execute a given file, directory, or network resource.

Least privilege is the governing principle across all three models. Every user, service account, and device should hold the minimum permissions needed to do its job — nothing more. Privilege creep, where permissions accumulate silently as roles evolve, is one of the most common causes of insider incidents and audit failures.

Policy enforcement points — firewalls, proxies, identity-aware gateways — are where authorisation decisions are actually applied. Defining a policy in your identity provider means nothing if the enforcement point is misconfigured or bypassed.

Authorisation: deciding what an authenticated user may do — overview diagram

Accounting: what gets logged and why it matters

Accounting is the service that records what authenticated, authorised users actually did. Fortinet’s security research notes that accounting logs are essential for detecting suspicious behaviour, meeting audit requirements, and supporting forensic investigation — they are far more than billing records.

Events worth capturing include: login and logout times, failed authentication attempts, privilege escalations, administrative commands issued, files accessed or modified, session durations, and any changes to access control policies themselves.

A practical logging checklist for operators:

  1. Log all authentication events, including failures, not just successes.
  2. Record the source IP address, device identifier, and timestamp for every session.
  3. Capture privilege changes and administrative actions in a separate, protected log stream.
  4. Store logs in a centralised, tamper-evident system — a local log that an attacker can delete is worthless.
  5. Define and enforce a retention period aligned to your regulatory obligations (many UK sectors require a minimum of 12 months).
  6. Test log integrity regularly; confirm that alerts fire when log ingestion stops.

Logs support three distinct functions: incident response (what happened and in what order), internal threat detection (spotting unusual patterns in legitimate user behaviour), and regulatory compliance (providing auditors with evidence that controls were operating). Without them, you are flying blind on all three. For guidance on building an audit-ready evidence trail, compliance auditing for UK security is a useful starting point.

AAA protocols: how RADIUS, TACACS+, and Diameter differ

AAA does not exist in the abstract — it runs on protocols. The three you will encounter most are RADIUS, TACACS+, and Diameter, each suited to different environments.

In a typical deployment, a network access server (a VPN gateway, a wireless controller, or a router) forwards credential requests to a central AAA server. That centralisation, as Wikipedia’s AAA overview notes, simplifies policy management and makes audits far more tractable than per-device configurations.

Cisco’s TACACS+ documentation sets out the key protocol differences clearly. Lenovo’s AAA glossary adds useful context on typical deployment patterns.

Protocol AAA handling Encryption Typical deployment
RADIUS Authentication and authorisation combined; accounting separate Password field only VPN gateways, wireless networks, ISP dial-up
TACACS+ Authentication, authorisation, and accounting fully separated Entire session payload Network device administration, privileged access
Diameter Evolved successor to RADIUS; full separation of functions TLS/IPsec Mobile telecoms, 4G/5G core networks

In UK enterprise, RADIUS remains the standard for Wi-Fi and VPN authentication. TACACS+ is the preferred choice where granular command-level authorisation on routers and switches is needed — a distinction that matters for infrastructure teams managing critical systems. Diameter is largely a telecoms concern, used by mobile network operators rather than typical enterprise IT teams.

Why AAA matters in the UK: NCSC guidance and compliance

The AAA triad maps directly onto the NCSC’s Cyber Assessment Framework (CAF), which sets out the controls expected of UK operators of essential services and critical national infrastructure. The CAF’s B-series objectives cover identity and access management explicitly, and accounting logs are a primary source of audit evidence.

Sector-specific implications include:

  • Financial services — the FCA expects firms to demonstrate that access to sensitive systems is controlled, logged, and reviewed. Accounting logs are the evidence.
  • Transport and logistics — operators of critical transport infrastructure must show that privileged access to operational technology is restricted and monitored, per CAF guidance referenced by Security.
  • Critical infrastructure — energy, water, and communications operators face the most rigorous expectations; AAA controls and their logs are examined during NIS Regulations assessments.

Pro Tip: Before a CAF assessment, pull a sample of your accounting logs and verify they contain the events an auditor would expect: failed logins, privilege changes, and administrative commands. If the logs are incomplete or gaps exist, that is a finding before the auditor even arrives.

A note from Securityjobsboard

At Securityjobsboard, we cover topics like the AAA triad because the UK security sector increasingly demands professionals who understand both physical and logical access control — and the roles that require this knowledge are growing. If you are building a career in security or looking to hire someone who can manage these systems, explore security roles across the UK on our platform.

Securityjobsboard

Sources

FAQ

What are the three access control security services?

The three access control security services are authentication (verifying identity), authorisation (granting permissions), and accounting (logging activity). Together they form the AAA triad used across network security and identity management.

What is the difference between authentication and authorisation?

Authentication confirms who you are; authorisation decides what you are allowed to do. Authentication always comes first — authorisation has no meaning without a verified identity to apply it to.

What are the main AAA protocols used in practice?

RADIUS is the most common protocol for VPN and wireless authentication, TACACS+ is preferred for network device administration because it separates and fully encrypts each AAA function, and Diameter is used primarily in mobile telecoms networks.

What types of access control systems implement AAA?

VPN gateways, wireless controllers, network routers, and identity management platforms all implement AAA. In a typical deployment, these devices forward authentication requests to a central AAA server, which applies policy and records accounting data.

Why does accounting matter beyond just keeping records?

Accounting logs are the primary evidence for incident response, internal threat detection, and regulatory audits. Without them, there is no reliable way to establish what happened during a security incident or to demonstrate to auditors that controls were operating correctly.