Authentication vs Authorization

Why they differ

Authentication asks who you are; authorization asks what you may do. Passing the first does not grant the second.

Identity & access

Checking that someone who logs in really is who they claim to be, usually by asking for a credential such as a password.

Formal

The process of confirming a claimed identity by checking one or more credentials - something the person knows, has or is - against what the system holds on record.

In plain English

Like a border guard comparing your face with your passport photo - the only question is “are you really you?”, not where you may go.

In practice

A payroll clerk in a municipality types her user name and password, then approves a prompt in an app on her phone; only then does the payroll system accept that it really is her.

Why it matters

Every later decision about access trusts the answer given here, so weak authentication lets an attacker walk in wearing someone else's identity.

Authorization

Identity & access

Deciding what an already identified user is allowed to do, such as which files they may open or change.

Formal

The decision, made after authentication, whether a given identity may perform a given action on a given resource, based on its permissions, roles or other rules.

In plain English

Like the coloured band on your wrist at a festival - the gate already knows who you are, and the colour decides whether you may go backstage.

In practice

A case officer at a municipal citizen service desk is logged in, but when she tries to open the payroll folder, the system checks her permissions and refuses, because only HR staff may read it.

Why it matters

When authorization grants more than people need, a single stolen login or careless employee can expose far more data than necessary.

Shared connections

Access control Access management API security Zero Trust