A user at Contoso enters their username and password to sign in to a company portal. After signing in successfully, the system checks whether the user is permitted to open the HR salary reports. Which security concept is being applied when the system determines what the user is allowed to access after sign-in?