Very often organizational laws specify the limits of a boss's authority. However, the position of a boss can best be secured based on the quality of his/her works and leadership skills.
Both or in some cases by either. In private establishment, it is often by performance or by family affairs. In some settings, for instance in politics, it is by law.