It would be absurd to interpret confidentiality as "ensuring that information is accessible only to those who are granted access when requested", because people who access systems e.g. with stolen passwords would then be "authorized".
It would be absurd to interpret it as policy enforcement because confidentiality would then be wrongly defined as "ensuring that information is accessible only to users whose access request has been approved by the system". This would be totally wrong because attackers who access systems e.g. with stolen passwords would then be "authorized".