Once an identity is authenticated, it must be authorized. Authorization is the process of verifying permissions and rights for an authenticated user.