Authentication answers: "Who are you?"

Authorization answers: "What are you allowed to do?"

A request can be successfully authenticated but still forbidden. For example, a normal employee can authenticate successfully but may not have permission to delete organization billing data.

Do not implement authorization merely by checking that a user is logged in. Authorization must evaluate the requested action against the resource and the caller's permissions.