Authentication confirms "who you are," authorization confirms "what you can do," and in terms of process, authentication precedes authorization, meaning unauthenticated requests do not enter the authorization process.