What is access control, what is its goal, and at what moment does it take place?

Access control is the monitoring and steering of access to resources, aimed at ensuring the integrity, confidentiality and availability of information, and it happens at runtime, the moment a subject tries to access a resource.

Two things are packed into this definition:

• Goal: the classic CIA triad. Keeping unauthorised subjects out protects confidentiality; keeping them from changing things protects integrity; and keeping authorised subjects able to get in protects availability. Access control serves all three, not only secrecy.
• Timing: access control is a runtime (execution-time) activity. It is the check performed when the access attempt actually happens, not something done in advance.

The timing point is what makes the next card necessary: a runtime check can only work if everything it relies on was prepared beforehand.

Go deeper:

• Access control (Wikipedia) — from physical doors to computer security, with the classic models (RBAC, ABAC, MAC) side by side.
• Information security: the CIA triad (Wikipedia) — what confidentiality, integrity and availability mean and why access control serves all three.