2.2.2. Authentication and Authorization
💡 First Principle: Authentication proves who you are; authorization decides what you're allowed to do once that's established — and because authentication always has to happen first, it's easy to mentally merge them, but a system can authenticate you perfectly and still correctly deny you access to something you have no authorization for.
| Question Answered | Authentication | Authorization |
|---|---|---|
| "Who are you?" | Yes — this is its job | No |
| "What can you do?" | No | Yes — this is its job |
| Happens first? | Yes, always | No, always second |
| Typical evidence | Password, MFA, biometric | Roles, permissions, policies |
| Failure looks like | "Invalid credentials" | "Access denied" for a verified user |
A verified, authenticated user can still be told "access denied" — that's authorization working correctly, not a system malfunction. Conversely, a user who never successfully authenticates never even reaches the authorization check.
⚠️ Exam Trap: A user who can sign in successfully but gets "access denied" on a specific resource does not have an authentication problem — resetting their password won't help. That's an authorization/permissions issue.
Reflection Question: A help desk ticket says "I can log into the portal fine, but I can't open the finance report." Is this an authentication issue or an authorization issue, and what should be checked first?
