Identity & access
The rules and mechanisms that decide who may use which systems, data or rooms, and in what way.
Formal
The enforcement of a policy on every request to use a resource, combining authentication (who is asking) with authorization (what they may do) to allow or refuse it. It covers digital resources and physical ones such as doors and server rooms.
In plain English
Like the whole door system of an office building - the key-card readers, the list of who may enter which floor, and the lock that actually holds the door shut.
In practice
At a Danish regional hospital, nurses can open records only for patients on their own ward; the patient record system checks every lookup against that rule and logs each refused attempt.
Why it matters
It is where the confidentiality and integrity of data are actually enforced; without it, every security policy is just words on paper.