How to distinguish the process of identity verification from the process of determining access rights in a system?

The process of verifying a user's identity is called authentication. It answers the question: "Who are you?" — that is, it confirms that the user really is who they claim to be. For example, entering a login and password, biometric data, or a one-time code.

The process of determining a user's rights is called authorization. It answers the question: "What are you allowed to do?" — that is, it checks which resources and actions are accessible to this user after successful authentication.

Example:

• The user enters a login and password — authentication occurs.
• After successful login, the system checks whether the user has rights to view a specific page or perform an operation — this is authorization.

Thus, authentication confirms identity, and authorization confirms access rights.