identity of the actor, not what resources the actor can access.
AUTHORIZATION: the process of determining whether an actor has the required privileges to
access a resource based on the permissions associated with that resource, in conjunction with
the implicit and explicit security policies for the system. This is different than authentication,