How to distinguish between a user identity verification process and determining their access rights in Spring Security?

In Spring Security, the process of verifying a user's identity is called authentication. It is responsible for confirming that the user truly is who they claim to be — for example, verifying login and password.

Access rights definition is authorization. It determines what actions or resources are permitted to the user after successful authentication.

Example:

• Authentication: the user enters login and password, the system verifies their correctness.
• Authorization: after login, the system checks whether the user can view a specific page or perform an operation.

In Spring Security, authentication is usually implemented through AuthenticationManager and UserDetailsService, while authorization is managed through access control rules (HttpSecurity, @PreAuthorize annotations, etc.).