Authentication is identity, authorization is permission

Authentication and authorization solve different problems.

Authentication answers: who is this user? Authorization answers: what can this user do now?

Mixing them creates weak products: a logged-in user is not automatically allowed to edit, buy, publish, export, or access every record.

The useful pattern is to centralize identity, then enforce permissions at the backend or gateway where the real action happens.

Frontend checks can improve UX, but they should not be the source of truth for access.

Login is the start of the security model, not the whole model.

Related:

• FrontEnd 101. SPAs and ways to do Auth
• Authentication
• Serverless Invoices repo
• Streamlit Authenticator example
• Streamlit auth experiments
• Make Podcast repo