The core idea

What is this user allowed to do?

Authorization decides permissions — whether an already-identified user may perform a given action or see a given resource.