Engineering / Reference
Authentication & authorization
Identity and permission are separate concerns.
Authentication establishes identity. Authorization determines what that identity can do.
A request should be evaluated against the actor, role, resource ownership or organization membership, and permitted operation.
Source discipline: current repository evidence first; supplied project specifications and documentation context second.