Controls that restrict system access based on roles and responsibilities, supporting data integrity and compliance (e.g., least privilege).