Glossary
Admission Control
Admission control is a gate that runs before policy evaluation, not instead of it. It answers a narrower question than authorization does: is this principal known and verifiable, and is it permitted to make requests of this kind in the first place? A principal that fails admission never reaches the point of having a specific action evaluated — there is nothing to evaluate, because the system does not recognize it as a legitimate participant.
Separating admission from the finer-grained decision that follows keeps the system's attack surface smaller: an unrecognized or unverifiable caller is rejected immediately, by a simple, fast check, rather than being allowed to probe the more complex policy logic behind it with requests that were never going to be admitted.