Separate Identity from Permission

Signing in answers only part of the question

Authentication checks evidence that a user controls the expected authenticator for a claimed identity. Authorization determines which actions that identity is permitted to perform. A successful sign-in does not make every database action appropriate. In a classroom role matrix, a scorekeeper may enter results while lacking permission to export contact records. Explain the decision through the assigned task, rather than treating every denied action as a failed login.