Does this refer to user permissions?

[oliviagallucci]

secure-sw-dev-fundamentals/secure_software_development_fundamentals.md

Line 214 in 6363337

* **Authorization**<br>Determine what that user is allowed (authorized) to do before deciding to do it. You can think of authorization as a list of what each user is allowed to do. If it is easy for an attacker to add authorizations, then secure I&A means little. This is critical for implementing confidentiality and/or integrity. Watch out: the words *authentication* and *authorization* sound similar, but they are not the same thing. You may know exactly who someone is (authentication), but still not allow that person to do something (authorization).

[david-a-wheeler]

Among other things, yes. Authorization determines what the user is allowed to do. It can be permission settings, but it can be other things too.