Access Control is all about the security features that control how users and systems communicate with each other systems and resources. The objective is to protect the systems and resources from unauthorized access.

The objective is to protect the systems and resources from unauthorized access.

To understanding the concept of access control, we need to understand the relationship between a subject and an object. In every scenario, the subject would always communicate to the Object. For instance, a person may access a file though you may have a computer communicate with another computer (e.g. a firewall through to a web service)

What I'm getting at is that the subject will always communicate to an object

Access = The flow of information between a subject and an object
Subject = The active entity that requests access to an object
Object = The passive entity that contains information

Identification = The way of a user claiming an identity to a system (ID card would be a good example) Authentication
= It establishes the user's identity and ensure the user is who they say they are (If you have a credit card, you can authenticate it's yours by entering in the pin number) Authorization
= The specific rights granted to an individual Accountability
= The ability to determine the actions and behavior of a single identity within the system, commonly by audit trails and logs