The distinction is irrelevant if you just consider that authorization (authZ) always happens after authentication (authN) but it is important when you realize t

The distinction is irrelevant if you just consider that authorization (authZ) always happens after authentication (authN) but it is important when you realize that different components/systems/protocols might be used in each. At that point, the separation is more about capabilities/responsibilities than "does it happen?" (This is what I do in my day job.)