Logged-in is not authorized

Authentication answers who is calling. Authorization answers what they may do. A valid session cookie, SSO assertion, or "user is logged in" middleware only proves identity. It does not decide whether