I came on to say much the same thing: a lot of authorization policies are very basic "is this a request by an authenticated user or service." But I also think

I came on to say much the same thing: a lot of authorization policies are very basic "is this a request by an authenticated user or service." But I also think the fact that they both get abbreviated to "auth" also causes a lot of bad mental modeling and poor communication.