Authentication vs. Authorization (Identity vs. Permission)¶

Verifying WHO someone is (authentication) is fundamentally different from determining WHAT they can do (authorization); conflating these creates security gaps.

Tension Addressed¶

Security vs. Usability

Recognizable As¶

Login systems separate from permission systems; OAuth (authentication) vs. OAuth scopes (authorization); "logged in but access denied" scenarios; service accounts with limited permissions; sudo as separate authorization step after authentication.

Canonical Sources¶

Lampson, "Protection" (1971); NIST Special Publication 800-63 (Digital Identity Guidelines)

Transfers To¶

Physical access (ID badge vs. key card zones), organizational hierarchy (employment vs. role), API design (API keys vs. scopes), database access (connection vs. row-level security)

Sub-concepts: - Authentication factors: Something you know (password), have (token), are (biometric) - multiple factors because each can be compromised differently - Session management: Binding authenticated identity to ongoing interactions; session is a claim to past authentication