Authentication and Authorization
Authentication proves who you are; authorization decides what you may do. They are distinct steps, and confusing them creates real vulnerabilities.
Two Different Questions
Authentication answers who are you and verifies the claim. Authorization answers what are you allowed to do and enforces it. A system can authenticate a user perfectly and still be broken if it then lets that user access things they should not. The two must both be present, in that order, and neither substitutes for the other.
Authentication Factors
- Something you know: password, PIN, passphrase
- Something you have: hardware token, phone, smart card
- Something you are: fingerprint, face, other biometrics
Combining factors from different categories yields multi-factor authentication, which resists the theft of any single factor. A stolen password alone is useless if a hardware token is also required.
Authorization Models
Once identity is established, authorization applies policy. Common models include role-based access control (RBAC), which grants permissions to roles that users hold, and attribute-based access control (ABAC), which decides based on attributes of the user, resource, and context. The guiding principle is least privilege: grant the minimum access the task requires.
Common Failures
Broken access control is among the most frequent serious web flaws: a user changes an identifier in a request and reaches another user's data because the system authenticated them but never checked authorization for that specific object. Every access must be mediated, every time.
Fusion Context
In a fusion plant, authorization is as consequential as authentication: an engineer authenticated for read-only monitoring must not be able to issue setpoint commands. The Hyperion breeder and burner control designs separate roles so that command authority over safety-relevant systems is tightly scoped and independently logged, and so that no single credential grants both broad access and the ability to erase its own audit trail.