The representation of rules or relationships that makes it possible to determine if a requested access should be allowed, given the values of the attributes of the subject/entity, object/resource, and possibly environment conditions.
Sources:
CNSSI 4009-2022 under policy from NIST SP 800-162 - adapted

  Statements, rules or assertions that specify the correct or expected behavior of an entity. For example, an authorization policy might specify the correct access control rules for a software component.
Sources:
NIST SP 800-95 from Open Grid Services Architecture Glossary of Terms
NISTIR 7621 Rev. 1 from NIST SP 800-95

  Statements, rules, or assertions that specify the correct or expected behavior of an entity. For example, an authorization policy might specify the correct access control rules for a software component.
Sources:
NIST SP 1800-15B from NIST SP 800-95, NISTIR 7621 Rev. 1
NIST SP 1800-15C from NIST SP 800-95, NISTIR 7621 Rev. 1

  The set of basic principles and associated guidelines, formulated and enforced by the governing body of an organization, to direct and limit its actions in pursuit of long-term goals.
Sources:
NIST SP 800-175A under policy

  A statement of objectives, rules, practices or regulations governing the activities of people within a certain context.
Sources:
NISTIR 4734