Permissions
A permission is an action that is granted to a role. Authorization happens when a user attempts to perform an action that is managed by permission. The role of that user is dereferenced and a set of aggregated permissions that have been granted to the user are checked.
Access control
Drupal leverages permissions as its means of access control. Users are assigned specific roles. Those roles have specific permissions assigned to them. Access control happens when a user attempts to act Drupal. Drupal will perform authorization based on the permissions granted to roles. As a simple example, the “manage users” permission can be granted to a role for human resources (HR), who are responsible for managing new hires or attrition. When one of the members of HR logs in and tries to go to Drupal’s user management page, they are granted access where other Drupal users would not.
Important note
It is good practice to implement a “least privilege...
