Prove an identity
Authentication checks a claim about who is signing in. Passwords, passkeys, and additional verification methods can help establish that claim. A successful sign-in identifies an account; it does not mean every resource should become available to it.
Decide what the identity may do
Authorization determines which actions an account can take. A student may view a class document while an instructor can edit it. Both people can authenticate successfully while receiving different permissions. Least privilege means granting the access needed for a task rather than every available capability.
Check the action, not just the login
Suppose a shared folder contains a schedule and private application records. Someone helping edit the schedule does not automatically need the private records. Separate resources or narrower permissions can reduce accidental exposure.
- Use individual accounts instead of sharing passwords.
- Distinguish viewing, editing, sharing, and administration.
- Review access when a person's responsibilities change.