What is the difference between authentication and authorization?

Authentication happens first: validate a password, session or token and produce a principal. Authorization then checks that principal against a policy for the specific action and resource. Confusing the two leads to endpoints that verify identity but never check ownership.

function requireRole(role) {
  return (req, res, next) => {
    if (!req.user) {
      return res.status(401).json({ error: "unauthenticated" });
    }
    if (!req.user.roles.includes(role)) {
      return res.status(403).json({ error: "forbidden" });
    }
    next();
  };
}

Models you will meet

• RBAC assigns roles and checks role membership
• ABAC evaluates attributes such as department, region or resource owner
• ReBAC checks relationships, such as whether a user is an editor of a document
• Row-level and tenant-level checks must happen in the query, not only in the UI
• Central policy services help, but the resource server must still enforce the decision

Authorization belongs on the server and close to the data. Hiding a button is not access control. For every mutation, check the action and the specific resource, including ownership and tenant boundaries. A role check on the route is not enough if the record belongs to another customer.