The input can be from a user or other sources such as a computing system.
The system can determine whether the source of the input is authorized to request the action specified in the request is permissible.