In the three-legged OAuth2 authorization workflow, which entity grants access to a protected resource?

The resource server hosts the protected resources and accepts access tokens to grant access, but it does not grant the initial access permission from the owner.

The resource owner is the user or entity who owns the protected resource and, through their explicit consent, authorizes the client application to access their data on the resource server via the authorization server. The authorization server acts as an intermediary, obtaining consent from the resource owner and issuing an access token.

The client is the application requesting access to the protected resource; it does not grant access itself.

The authorization server issues access tokens after obtaining consent from the resource owner, but it is not the owner who grants the access, rather it facilitates the owner's grant.