Authentication establishes who or what is making a request. Authorisation determines whether that identity may perform an action on a particular resource. Both need deliberate design.
Security Framework
Identity & Access
Establishing identity and deciding what each identity may do.
Introduction
Why it matters
These distinctions help explain login failures, expired sessions and unexpected permission errors. In application security, they are central to protecting accounts, privileged actions and data belonging to different users or tenants.
Key topics to explore
- Authentication versus authorisation
- Password storage and multi-factor authentication
- Session creation, expiry and revocation
- Roles, permissions and resource ownership
- Service identities, tokens and least privilege
Practice & notes
Possible first exercise: Create an access matrix for a local test application, then check allowed and denied actions using two separate test accounts.
Future notes will record the setup, observations, open questions and principles learned. This exercise is a starting idea, not a completed assessment.