Authorization model that restricts actions at the level of resources, fields, or operations.