Object can be any system resource subject to access control.

Operation is a method, which upon invocation exexutes some function for the user.

Permission is a a combination of object & operation that can be enforced.

Role is a job function within the context of an organization.

Session represents a user as owner and an active role set.

User represents a human being.