Definition:

… who is authorized to access to the product (both functionality and data), under what circumstances that access is granted, and to which parts of the product access is allowed.

Volere+2012, p. 60