Cybersecurity glossary
What is Authentication, Authorization and Accounting (AAA)?
Learn what the AAA framework is, how authentication, authorization, and accounting work together for network and application access control, and how to apply AAA securely.
Definition
Authentication, Authorization and Accounting (AAA) is a security framework that verifies identity, decides what that identity may access, and records activity for audit, billing, or compliance—commonly used in network access control and broader identity systems.
Why the AAA model still matters
Secure access is not a single gate. Authentication, Authorization and Accounting (AAA) describes a complete loop: prove identity, grant only what is needed, and keep a trustworthy record of activity.
Network engineers historically applied AAA to VPN, Wi-Fi, and device admin access. Application and cloud teams face the same loop whenever users, workloads, or APIs touch sensitive resources.
The three pillars
Authentication
Verify the subject with passwords, certificates, MFA, federation, or device identity before trust begins.
Authorization
Map the verified subject to allowed commands, VLANs, APIs, roles, or resource scopes.
Accounting
Record session metadata, privileged actions, and outcomes for audit, billing, and incident response.
How AAA flows at runtime
Access request arrives
A user, device, or service attempts network login, SSO, or an API call.
Authenticate against a trusted source
Credentials or cryptographic proofs are checked via IdP, directory, certificate, or AAA server.
Authorize the session or action
Policy assigns group membership, command sets, scopes, or network placement.
Account for the activity
Start/stop records, command logs, or API audit events are written to durable storage.
Revoke or re-evaluate
Session end, risk change, or privilege expiry triggers re-auth or access removal.
Classic protocols and modern equivalents
| Layer | Classic AAA | Modern analogue |
|---|---|---|
| Authentication | RADIUS / 802.1X credentials | OIDC, SAML, passkeys, workload identity |
| Authorization | TACACS+ command sets, VLAN assignment | RBAC/ABAC, OAuth scopes, PAM elevation |
| Accounting | RADIUS accounting start/stop | Cloud audit logs, SIEM, immutable trails |
| Policy store | Directory + AAA server | IdP + IAM + policy-as-code engines |
Gaps that break the AAA loop
- Auth without AuthZ depth — everyone who logs in receives nearly identical rights.
- AuthZ without accounting — privilege works, but investigations have no evidence.
- Local overrides — shared device passwords bypass central AAA for “emergencies” that never end.
- Log integrity failures — administrators can alter or disable the only audit trail.
- Incomplete coverage — SaaS admin consoles and CI/CD identities sit outside the AAA design.
Building resilient AAA
- Centralize authentication on hardened identity providers or AAA servers; avoid unmanaged local accounts.
- Apply least privilege and just-in-time elevation instead of standing admin groups.
- Capture high-fidelity accounting for privileged commands and sensitive data access.
- Ship logs to an append-friendly destination that privileged operators cannot silently rewrite.
- Correlate AAA events with endpoint, network, and application telemetry in a SIEM.
- Test joiners, movers, and leavers so authorization and accounting stay aligned with HR reality.
- Protect break-glass accounts with monitoring, dual control, and rapid rotation.
- Review RADIUS/TACACS+/IdP configurations for weak shared secrets and outdated crypto.
AAA as an operating model
Treat AAA as a product requirement for every new access path: remote admin, partner federation, machine-to-machine APIs, and temporary contractor access. If any pillar is missing, security becomes either porous or unprovable.
The practical takeaway
AAA is the trio of verify, decide, and record. Strong authentication without constrained authorization overshares; strong authorization without accounting leaves you blind after misuse.
Design every access path so identity is proven, permissions are minimal and explicit, and actions leave an audit trail you can trust under pressure.
Related security terms
Authentication
The first AAA pillar: proving who the subject is.
Authorization
The second AAA pillar: deciding what the subject may do.
Identity and Access Management (IAM)
Broader lifecycle and governance of identities and entitlements.
LDAP
Directory technology often queried by AAA and IAM systems.
Least Privilege
Authorization principle that limits standing access.
Frequently asked questions
What does AAA stand for in security?
AAA stands for Authentication, Authorization, and Accounting—three complementary controls for verifying identity, granting permissions, and recording what happened.
Is AAA only for network devices?
AAA originated in network access (RADIUS, TACACS+), but the same three pillars apply to applications, APIs, cloud IAM, and zero-trust architectures.
What is the accounting part of AAA?
Accounting (sometimes called auditing) logs session start/stop, resource usage, privileged commands, or API activity so teams can investigate incidents, meet compliance needs, or bill for usage.
How do RADIUS and TACACS+ relate to AAA?
Both are classic AAA protocols. RADIUS is widely used for network access authentication and accounting; TACACS+ is often preferred for device administration with finer command authorization.
What happens if accounting is weak?
You may block unauthorized access in theory but cannot prove who did what, detect privilege abuse, or support forensics after a breach.
How does AAA differ from IAM?
AAA describes the runtime control loop for access events. IAM is the broader discipline covering identity lifecycle, federation, governance, and policy across systems.
What are AAA best practices?
Centralize identity sources, enforce strong authentication, apply least privilege, send immutable audit logs to a SIEM, and separate duties so administrators cannot silently erase their own trails.
References
Explore authoritative guidance and frameworks related to authentication, authorization and accounting (aaa).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.