| Authorization is the half of access control that deals with privilege (authentication is the other half, which deals with identity). Most people are familiar with access control lists (ACLs), which are a form of centralized authorization. Certificates are the principal method of implementing decentralized authorization.
In centralized auth, each time an entity wants to access some resource, the gatekeeper in charge of that resource verifies the entity's entitlement against a centralized authorization database. In decentralized auth, the gatekeeper checks a signed credential which the entity presents.
The centralized system has the advantage that revocation of privilege is immediate, although it gains this at the cost of a slower authorization mechanism - each request needs to return to the authoritative data store, which leads to a scalability issue.
Decentralized auth has the reverse setup - verifications are fast, and scale nicely - each entity receives its credential once from a central authority, and use it many times at the edge - at the cost of slow revocation. Each gatekeeper must maintain an authoritative negative permission list, instead of the positive list. | 
