Access control is the set of policies and mechanisms that decide who(or what) can do what on which resource—and under which conditions. It limits access to systems, data, APIs, devices, or physical spaces so only authorized subjects can perform permitted actions, implementing least-privilege and auditability.