That is authentication, which is orthogonal to authorisation.<p>It&#x27;s very common to see a system with a reasonable authentication system which is yet compromised by having little to no authorisation.<p>(A classic example of this is where after logging in as a normal user, you can still hit the &#x2F;admin&#x2F; endpoint.)