Authentication vs authorization vs RBAC?
Understand the concept
Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.
Important ideas
-
Authentication checks identity; authorization checks access.
-
RBAC assigns permissions through roles.
-
Also check record ownership and tenant boundaries on each protected operation.
-
Use record ownership or tenant scope in addition to broad roles, and deny access when the relevant rule cannot be established.
Comparison:
| Point | Authentication | Authorization |
|---|---|---|
| Question | Who is the caller? | May this caller do this? |
| Example | Verify a login/session/token | Verify ownership of an order |
| Typical failure | 401 for missing/invalid credentials | 403 for known but disallowed access |
| Checked only at login | No; requests need identity context | No; check each protected operation |
- Some APIs use 404 instead of 403 to avoid revealing that a protected resource exists.
Can you explain it without the notes?
Authentication vs authorization vs RBAC?
Use your own words. Explain an example and one limitation before checking the explanation.
Check your explanation
Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.
Turn this concept into a clear answer.
- Give an example where authentication succeeds but authorization fails, such as a normal user calling an admin endpoint.
Adapted from 08_PERFORMANCE_SECURITY.md · “Authentication vs authorization vs RBAC?”. Examples are study fragments; framework behavior can depend on your version.