Software Engineering · Security
Deciding what an already-authenticated user is allowed to do or see.
Example: An admin can delete records; a regular user can only view them.
In practice: A system that authenticates users but skips authorization checks lets any logged-in user do anything — a common oversight in early-stage apps.