Authorization is the function of specifying access rights to resources. The Application Server implements an authorization model based on privileges that grant access to content, structure and services of Redbex.

A privilege defines a permission that a specific user or a specific user group is granted on a specific object.

The authorization model used in the Application Server is additive, i.e. a user has no permissions on any resource if no permission was granted through a privilege. Newly created users have no privileges by default.

Redbex does not have negative privileges that can take away permissions granted through another privilege.