Authentication is who you are and authorization is what you are allowed to do. I have spent great effort writing a new software system that has no servers and

Authentication is who you are and authorization is what you are allowed to do. I have spent great effort writing a new software system that has no servers and no third parties yet still solves for authentication. It really matters less who a person is than whether you are willing to trust that person irrespective of who they are, because trust describes the relationship not the person at the terminal end of that relationship. As for traditional systems, the rest of the world, you access a system with either a certificate or a username/password. The certificate is created by the server often based upon a key pair. In the case of a username/password the server stores a hash sequence of your password and compares that stored hash against the hashed output of a password you enter to login. Once access is granted there are actions you are allowed to perform and actions you are denied. This is authorization.