it centralizes information about authorization - the objects in your system and the relationships between them - in such a way that you can define your authorization logic in one place and then callers can just ask "does this user have this permission on this object?"