Authentication vs Authorization

Authentication (AuthN) and Authorization (AuthZ) are the foundational pillars of system security. They are distinct concepts that answer two different questions: "Who are you?" and "What are you allowed to do?"

Authentication (AuthN)

Verifies the identity of a user, device, or service. It usually happens first. Mechanisms include:

• Something you know: Passwords, PINs.
• Something you have: Authenticator apps (TOTP), SMS codes, physical security keys (YubiKey).
• Something you are: Biometrics (FaceID, fingerprint).

Authorization (AuthZ)

Determines whether an authenticated entity has permission to access a specific resource or perform a specific action. Mechanisms include:

• Role-Based Access Control (RBAC): Permissions are tied to roles (e.g., "Admin", "Editor"), and users are assigned roles. Best for standard business apps.
• Attribute-Based Access Control (ABAC): Permissions depend on attributes (e.g., "Can edit if document.owner == user.id AND time < 5pm"). More flexible but harder to compute.
• Access Control Lists (ACL): A list attached directly to a resource explicitly stating who can access it.

Strong authentication (like MFA) adds friction to the user experience but vastly improves security against credential stuffing. Fine-grained authorization (ABAC) gives perfect control but adds significant computational overhead to every database query compared to simple RBAC. In distributed systems, centralizing AuthN at an API Gateway is easy, but AuthZ must often be pushed down to individual microservices because only the microservice knows the business logic required to make the access decision.

• Never confuse the two terms. If asked about security, explicitly state "First we authenticate the user, then we authorize the action."
• Know the HTTP status codes: 401 means "I don't know who you are" (AuthN failed). 403 means "I know who you are, but you can't do this" (AuthZ failed).
• In a microservices architecture, propose authenticating once at the API Gateway and passing identity (usually via JWT) to downstream services to perform their own authorization.