Authorization
Problem
You've authenticated as Alice.
That doesn't mean Alice should be allowed to:
DELETE /all-customers
Identity alone doesn't determine permission.
Solution — Authorization
The system evaluates what the authenticated identity may do.
Alice ↓ Can read invoices ✓ Can delete company ✗
Core idea: authentication asks who are you? Authorization asks what may you do?