Abstract: An authentication and authorization system acquires an authentication and authorization request for requesting authentication and/or authorization when a request source asset requests a request destination asset to perform predetermined processing, analyzes the authentication and authorization request to specify at least one of asset statuses indicating target matters of the authentication and/or authorization for the request source asset and the request destination asset, a request level indicating a degree of confirmation required for the authentication and/or authorization in response to the authentication and authorization request, and a relationship between the request source asset and the request destination asset, and determines the authentication and authorization means to be used for the authentication and/or authorization in response to the authentication and authorization request, based on the specified at least one of the asset statuses, the request level, and the relationship.