Authentication & Secrets
Authorization
Also: authz, access control
Deciding what an identified user or program is allowed to do.
In more detail
Authorization runs after authentication, on every request: may this user read this record, run this action, use this token for this purpose? It must be enforced on the server. Missing or incomplete authorization checks are among the most common serious flaws in real applications.