Authorization/Approval of the System
The authorization decision is a risk acceptance
Authorization is the senior official's formal decision that a system may operate with a documented set of controls and an accepted level of residual risk. The decision rests on the authorization package: the security plan, the assessment report, the POA&M, and the risk assessment, often summarized through a continuous monitoring strategy. The AO chooses among authorization to operate, authorization to operate with conditions (time-bound and specific), interim authorization to test or operate, or denial. Joint authorization shares one decision across systems using a common provider; leveraged authorization lets one system reuse another's approved controls.
Residual risk drives the decision. Risk can be accepted, avoided, mitigated, or transferred/shared, but only the AO - or the senior official holding that authority - accepts it on behalf of the organization. The decision is documented, scoped, time-bounded, and tied to continuous monitoring.
Traps
Questions love to put the decision in the wrong hands: the system owner recommends, the ISSO supports, the assessor informs - the AO decides. Interim authorizations expire and are not a way to skip remediation. Conditions must have owners and dates; "authorization with conditions" without deadlines is a red flag. Authorization is also not permanent; a significant change or a failed monitoring cycle can suspend or revoke it.
Rule of thumb
If residual risk exceeds the AO's tolerance and no mitigation closes the gap, the correct answer is denial or a time-limited conditional authorization - never an unconditional signature.