Authentication establishes who the user is. Authorization decides what that user may access or change. A valid session does not automatically grant permission to every resource. Enforce permissions on the server for protected pages, API routes, and mutations; hiding a button in React is not security.