Authentication vs Authorisation: Identity and Permissions Explained
Does signing in mean someone can change every setting? Checking identity and granting permissions are different jobs.
1:47 · No narration: the video shows each step as text on screen, and every step is written out below, with buttons that jump the video to it.
Prefer YouTube? Watch this video on our YouTube channel (opens in a new tab).
The six points in the video
This is a silent video. The headings, explanations and labels below reproduce the information on screen.
-
Step 1: Authentication checks identity
A sign-in process verifies the identity being presented.
On-screen labels: Account identity; Sign-in evidence; Authentication check.
-
Step 2: Authorisation checks permission
The system decides whether that account may perform an action.
On-screen labels: Requested action; Account permissions; Allow or deny.
-
Step 3: An editor may edit content
A content role need not include billing or account administration.
On-screen labels: Page editing; Defined role; Limited permissions.
-
Step 4: An admin has broader powers
Grant administrative access only when the work requires it.
On-screen labels: User management; System settings; Higher-impact changes.
-
Step 5: Hiding a button is not enough
The service must enforce the permission when the action is requested.
On-screen labels: Server-side check; Protected operation; Denied unauthorised action.
-
Step 6: Review both parts of access
Strong sign-in protection and appropriate permissions work together.
On-screen labels: Protected sign-in; Suitable role; Regular access review.
A practical check for your business
Trace a sensitive task through sign-in and the permission check that follows it. Confirm that a person who can identify themselves still receives only the actions and information their role permits.
Sources and further detail
Common questions
Does signing in mean someone can change every setting?
Checking identity and granting permissions are different jobs. Check identity and limit the actions each account can take.
Go further
More video tips
All 205 videos →
Least Privilege Explained: Give Website Users the Access They Need
Least privilege, explained.
Business Account Recovery: 6 Checks Before You Lose Access
Protect business account access.