Authentication vs authorization

Authentication: who are you? Authorization: what may you do? AI often forgets the second when login exists—e.g. `/api/notes/3` stays open to any logged-in user.