Authorization is the module of an application that is responsible to manage user access to the application resources.
Please do not mix Authorization with Authentication. As stated authorization is concerned about managing user access to the application resources whilst authentication is concerned about identifying a user of an application.
In authorization there are three different actors: Actions, Users and Resources. The most common way to read an authorization rule is in the following way: "A user may do those actions over that resource" or "A user may do those actions over that type of resource"
There are some distinct ways to specify that rules, I will leave here two: