Is it possible to implement an authorization system without verifying the identity of the user?

Implementing an authorization system without verifying the user's identity is possible in limited scenarios, for example, when access is granted based on other factors not related to identification, such as IP address, access tokens without user binding, or anonymous sessions.

However, in the traditional understanding, authorization is the process of determining the user's rights after authentication (identity verification). Without verifying the identity, it is impossible to accurately determine what rights or access the subject should have, which reduces security.

Example: a public API with a request limit per IP address — here, authorization occurs without explicit identity verification, but this is more of an access restriction rather than full authorization.