# Authorization and Consent

The concepts of consent and authorization in Smile CDR are related but distinct. When a FHIR request is being processed, there are two specific layers that are invoked to make decisions on whether the request can proceed and what data is ultimately disclosed: The **Authorization Service** and the **Consent Service**.

The following diagrams show the functionality provided by each of these layers.

# Authorization Service

The following diagram shows the primary purpose of the Authorization Service.

The Authorization Service looks at every request (including both the details of the request, and any data being returned) and makes a determination about whether the operation should be permitted or blocked.

As inputs into its decision, the Authorization Service uses:

- Any [Roles and Permissions](/content/docs/security/roles_and_permissions.html) granted to the user or their session
- Any [SMART on FHIR scopes](/content/docs/smart/smart_on_fhir_scopes.html) that have been approved for the requesting client (generally applies only to SMART on FHIR [Interactive User Launch](/content/docs/smart/smart_on_fhir_authorization_flows.html) flows)
- Any [Roles and Permissions](/content/docs/security/roles_and_permissions.html) granted to the client (generally applies only to SMART on FHIR [Client Credentials](/content/docs/smart/smart_on_fhir_authorization_flows.html#client-credentials-flow/index.html) flow)
- Any [Roles and Permissions](/content/docs/security/roles_and_permissions.html) granted to the [Anonymous user](/content/docs/security/anonymous_access.html) when invoking an anonymous operation.

The Authorization Service makes a simple binary determination: either the request is authorized, or it is blocked and the client will see an _HTTP 403 Forbidden_ response.

# Consent Service

The following diagram shows the primary purpose of the Consent Service.

The Consent Service looks at every request and makes a determination about whether any data being exposed is acceptable for the user to see, and optionally removes it from what is returned. This removal may include filtering out entire resources _(i.e. blocking)_, and/or filtering out certain elements of resources being returned _(i.e. masking)_.

The consent service is a very flexible mechanism, based entirely on programmed consent rules. Unlike the Authorization Service, which uses a fixed set of inputs (permissions and scopes) to make decisions, the consent script may use any of a number of inputs including but not limited to:

- Logged-in User and Session Details
- Consent Records (i.e. Consent resources that have been stored in the CDR)
- Local policies expressed in code or in 3rd-party formats

See [Consent Service](/content/docs/security/consent_service.html) for information on setting up the consent service.

[Authentication Protocols](/content/docs/security/authentication_protocols.html)

Authorization and Consent

Security

[Authentication Protocols](/content/docs/security/authentication_protocols.html)
[Authorization and Consent](/content/docs/security/authorization_and_consent.html)
[Inbound Security Module](/content/docs/security/inbound_security_module.html)
[Local Inbound Security Module](/content/docs/security/local_inbound_security_module.html)
[LDAP Inbound Security Module](/content/docs/security/ldap_inbound_security_module.html)
[Scripted Inbound Security Module](/content/docs/security/script_inbound_security_module.html)
[SAML Inbound Security Module](/content/docs/security/saml_inbound_security_module.html)
[Trusted Client Mode](/content/docs/security/trusted_client_mode.html)
[Roles and Permissions](/content/docs/security/roles_and_permissions.html)
[Callback Scripts](/content/docs/security/callback_scripts.html)
[Anonymous Access](/content/docs/security/anonymous_access.html)
[Consent Service](/content/docs/security/consent_service.html)
[Consent Service: JavaScript API](/content/docs/security/consent_service_javascript.html)
[Consent Service: Java API](/content/docs/security/consent_service_java.html)
[Security Recipes](/content/docs/security/security_recipes.html)
[Two Factor Authentication](/content/docs/security/two_factor_auth.html)
[Password Hashing Algorithms](/content/docs/security/password_hashing_algorithms.html)
[JWT Signature Algorithms](/content/docs/security/jwt_signature_algorithms.html)
[Troubleshooting Security](/content/docs/security/troubleshooting_security.html)

[Inbound Security Module](/content/docs/security/inbound_security_module.html)