Authorization
Authorization determines whether a user, application, or other principal is permitted to perform a particular action on a resource.
Permission to do a particular thing
An application can let someone read a record while refusing to let them change it. Both decisions concern authorization. The relevant rules may come from roles, permissions, or another access-control model used by the service.
For a token-based API, the service must validate the token and decide whether it permits the requested operation. Possessing an access token does not mean every operation is allowed.
A system permission is not a business approval
An administrator may have permission to replace an employee’s authentication method. Whether a particular replacement request should be approved is a separate question for the recovery process.
This distinction helps during investigations: the application record can show that an authorized account made a change, while the approval record explains why the organization allowed it. A technically permitted action can still violate the organization’s procedure.
Authentication establishes use of an account’s authenticator. Authorization determines the access allowed to that account or application. Neither establishes that a caller’s story is true.