Authorization AuthZ
Deciding what an already-authenticated user is allowed to do.
"Can Anna delete this file?" "Can this service call that API?" Implemented via RBAC, ABAC, ACL or policy engines (OPA, Cedar). Common bugs: forgetting to check on the server ("client-side authz" is broken).