In principle, simply holding an edu-ID account does not entitle a user to access services. As anyone can create an edu-ID account, it would not be appropriate to automatically link valuable access rights to the posession of an account. For this reason, Switch edu-ID keeps authentication and authorisation separate.
Authentication ensures that the edu-ID account can only be used by its owner. The entire authentication process is under control of the Switch edu-ID IdP.
The authorisation process determines whether the person in question is actually authorised to access a service. Once authentication has been completed, the edu-ID IdP sends user attributes to the service, which then grants or denies access based on its own defined rules. The authorization process is therfore mostly
Currently, only very limited access rules can be defined on the IdP level (in the resource registry).