That is authentication, which is orthogonal to authorisation. It's very common to see a system with a reasonable authentication system which is yet compromised

That is authentication, which is orthogonal to authorisation. It's very common to see a system with a reasonable authentication system which is yet compromised by having little to no authorisation. (A classic example of this is where after logging in as a normal user, you can still hit the /admin/ endpoint.)