AAA and Network Identity Controls

AAA is a model for controlling access to a network or device:

• Authentication verifies an identity.
• Authorization decides what that identity may do.
• Accounting records access and activity for operations, investigation, or audit.

Authentication alone is not sufficient. A successful login should grant only the permissions appropriate to the person, device, role, and context. This is the principle of least privilege.

Two distinct access paths

1Employee Wi-Fi
2  → authenticate identity and device
3  → apply network-access policy
4  → authorize only the intended network resources
5
6Switch administration
7  → authenticate administrator
8  → authorize an administrative role or permitted commands
9  → record the administrator's session and actions

The device-administration path usually needs stricter authorization and logging than ordinary user access. For example, TACACS+ is often selected where command-level control and accounting for network-device administrators are required, whereas RADIUS is commonly used for network access or VPN authentication.

Build a defensible access design

• use individual identities rather than shared administrator accounts;
• require stronger authentication for high-impact access;
• assign roles and permissions narrowly, then review them regularly;
• log successful and failed administrative access in a protected, searchable location;
• remove or disable access promptly when a role, device, or employment relationship changes.

Federation and SSO can reduce password friction, but neither automatically grants least privilege. Authorization decisions and access reviews remain necessary after identity is established.

For the protected device path that these controls support, see Network Remote Management.