Explain authentication vs authorization in a modern SaaS app

Interview framing: Authentication answers "who are you?" Authorization answers "what are you allowed to do right now?" A strong answer separates UX hints from enforceable security.

Key concepts:

1. Authentication:

• Login, identity proof, MFA, sessions, tokens, and identity provider integration.
• The frontend can store and refresh session state, but should avoid exposing secrets.

2. Authorization:

• Determines whether a subject can perform an action on a resource under a context.
• Inputs can include role, attributes, tenant, resource ownership, device, risk, time, and environment.

3. Frontend responsibility:

• Hide or disable actions the user cannot take to improve UX.
• Request allowed actions/capabilities from the backend when possible.
• Treat frontend checks as non-security boundaries because users can modify client code.

4. Backend responsibility:

• Enforce every sensitive read/write/API call server-side.
• Return 401 for unauthenticated, 403 for authenticated but unauthorized.
• Audit denied and sensitive allowed decisions.

5. Models:

• RBAC maps users to roles.
• ABAC evaluates attributes.
• PBAC centralizes business policies that combine identity, resource, action, and context.

Good closing: "In the UI I can make authorization visible and usable, but the final decision must be enforced by trusted backend or policy infrastructure."