In legal terms, authorization is the formal grant of power from a person or entity that holds that power to another person who may then act within a clearly defined scope. The legal definition of authorization rests on three fixed elements: a grantor with real authority to give, a grantee who receives it, and a boundary around what the grantee may do. Anything the grantee does inside that boundary binds the grantor. Anything outside it is unauthorized, and the law generally treats unauthorized acts as unenforceable against the grantor, sometimes voidable, and in certain settings criminal.
The word surfaces in contracts, agency law, corporate governance, estate planning, and criminal statutes, and the structure stays the same across all of them. What changes is who can grant, what counts as scope, and what happens when someone acts beyond it.
The Two Elements Every Grant of Authority Needs
A grant of authority is only valid if the grantor actually possesses the power being handed over. You cannot authorize what you do not hold. A property owner can authorize an agent to sell a building; a tenant cannot. A corporate board can authorize an officer to sign a loan; a shareholder, acting alone, cannot.
Scope is the second fixed element. Every grant has edges, and courts read those edges strictly. An agent authorized to negotiate a lease cannot use that same authority to sell the building. The lease authority ends at the lease.
When an organization acts beyond its own charter or bylaws, courts call the act ultra vires, meaning “beyond the powers.” The concept applies when a company or government body takes action outside its legally permitted scope. If a corporation’s bylaws require a board vote before removing a director and the CEO fires one unilaterally, that removal is ultra vires and can be challenged.1Legal Information Institute (LII) / Cornell Law School. Ultra Vires The principle reinforces the basic rule: authorization only stretches as far as the document or law that created it.
Types of Authority an Agent Can Hold
Agency law, the body of rules governing one person acting for another, recognizes several ways authority can arise. The distinctions matter because they decide whether a principal is bound by what the agent did.
Express authority comes from direct instructions. If you tell your real estate agent to accept any offer above $400,000, that is express authority. It is the cleanest category because the words themselves define the scope.
Implied authority covers tasks reasonably necessary to carry out the express instructions. The same agent has implied authority to schedule showings and share listing details, even if you never specifically said so. Courts fill in these gaps based on what the role ordinarily requires.
Apparent authority catches many principals off guard. It arises when a third party reasonably believes, based on the principal’s conduct, that someone has authority to act. If you let a former employee continue using company business cards and email after termination, a client who signs a contract with that person might hold you to the deal based on apparent authority.2Legal Information Institute (LII) / Cornell Law School. Apparent Authority The decisive question is whether the third party’s belief was reasonable and traceable to something the principal said or did. Apparent authority exists even when the agent had no actual power at all.
When an agent acts outside any recognized authority, the principal is not automatically bound. But if the principal later endorses the unauthorized act, that endorsement, called ratification, retroactively validates the agent’s actions as if authority had existed all along. Ratification can be express or inferred from accepting the benefits of the deal.
Authorization vs. Authentication
These two terms get confused constantly, and the distinction is worth pinning down because the legal consequences differ. Authentication answers the question “who are you?” Authorization answers “what are you allowed to do?” When you type your password into a banking app, the system authenticates you by verifying identity. Once inside, authorization determines whether you can view balances, transfer funds, or change the mailing address. A bank teller authenticated through an employee badge may be authorized to process deposits but not to approve a mortgage.
An authentication failure means an imposter got in. An authorization failure means someone who legitimately logged in reached data or performed actions beyond their role. Statutes and contracts often target one or the other specifically, so getting the vocabulary right matters when reading them.
How Authorization Is Formally Established
Granting permission is only useful if you can prove it later. The methods for formalizing authorization vary by context, but each one creates a verifiable record tying the grant to the person who gave it.
Written instruments are the traditional workhorse. Powers of attorney, letters of authorization, and agency agreements spell out who is granting authority, who is receiving it, and exactly what the recipient may do. For high-stakes documents like property deeds and powers of attorney, notarization adds a layer of proof: a notary public confirms the signer’s identity and willingness to sign. Notarization does not validate the content of the document, but it creates strong evidence that the person granting authority did so voluntarily.
Electronic signatures carry equivalent legal weight in most settings. Under the Electronic Signatures in Global and National Commerce Act, a contract or authorization cannot be denied legal effect solely because it was signed electronically. The statute defines an electronic signature as any sound, symbol, or process attached to a record and executed with the intent to sign.3Office of the Law Revision Counsel. 15 USC Chapter 96 – Electronic Signatures in Global and National Commerce
Corporate authorization follows its own forms. When a corporation needs to authorize an officer to open bank accounts or sign contracts, the board of directors passes a formal resolution. A valid resolution names the authorized individuals, describes the specific actions they may take, states an effective date, and is certified by a corporate officer other than the person receiving the authority. Banks and counterparties routinely ask for a copy before accepting the officer’s signature as binding on the company.
In digital systems, X.509 certificates bind a user’s or server’s identity to a cryptographic key, and a trusted certificate authority vouches for the link. Extensions within the certificate can restrict exactly what the key may be used for, such as signing code versus encrypting email. The certificate functions as the digital analog of a signed authorization.
When Authorization Ends
Authorization does not last forever, and the way it ends is often as consequential as how it began.
A principal can revoke a power of attorney at any time by delivering written notice to the agent. The harder part is making sure third parties know the authority has ended. Banks, hospitals, and business partners holding the old document on file may continue honoring it unless notified directly. Retrieving and destroying old copies, or at minimum marking them as revoked, prevents a former agent from continuing to act on outdated authority and prevents apparent authority from lingering in the eyes of outside parties.
Some terminations happen automatically. An agency relationship typically ends by operation of law when either the principal or agent dies, when either party becomes incapacitated, or when the purpose of the agency becomes impossible or illegal. Bankruptcy of either party can also terminate the relationship. These triggers apply regardless of whether anyone sends a formal notice, though third parties may not know unless told.
Incapacity has a special wrinkle. A standard power of attorney dies the moment the principal becomes mentally incapacitated. If you signed a document letting your daughter manage your finances and then suffered a stroke, her authority would be suspended. A durable power of attorney, by contrast, is specifically drafted to survive incapacity. Every state permits some form of durable power, though the required language and witness formalities vary. Getting this wrong means the people you chose to handle your affairs could be locked out at exactly the moment you need them most, forcing your family into a court-supervised guardianship instead.
Corporate authority follows similar logic with added formality. A board resolution granting signing authority to an officer remains in effect until the board passes a new resolution revoking or replacing it. When officers leave, updating banking authorizations and notifying key counterparties promptly heads off the apparent authority disputes that otherwise follow.
When Acting Without Authorization Becomes a Crime
In most civil contexts, acting without authorization means the act is unenforceable or the actor is personally liable. In the computer context, it can mean prison. The Computer Fraud and Abuse Act makes it a federal crime to access a computer without authorization or to exceed the authorization given. The statute defines “exceeds authorized access” as using legitimate access to obtain or alter information the user was not entitled to reach.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
That language created years of confusion over whether it reached employees who had access to a database but used it for personal reasons. The Supreme Court settled the question in Van Buren v. United States (2021). A police officer had used his patrol car computer to search a license plate in exchange for a bribe. He unquestionably had access to the database, but used it for an unauthorized purpose. The Court held that the statute only criminalizes accessing areas of a computer that are off-limits to the user, not misusing information the user was otherwise entitled to view.5Supreme Court of the United States. Van Buren v. United States, 593 US 374 (2021) The ruling drew a line that mirrors the civil definition of authorization: the question is whether the actor crossed into a restricted zone, not whether the actor had a bad motive.
Penalties under the CFAA vary by what the offender accessed and why. Unauthorized access to a protected computer to obtain information carries up to one year in prison for a first offense, rising to five years if the access was for financial gain or the stolen data was worth more than $5,000. Intentionally damaging a computer system without authorization can bring up to ten years.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Repeat offenders face doubled maximums across the board.
The thread running through every setting is the same. Authorization is a bounded grant from someone who holds the power. Stay inside the lines and your acts bind the principal. Cross them, and the consequences depend on which body of law you are standing in.