01 / What each boundary answers
Compare the decision, not the label.
Establishes which caller or workload presents a valid credential. Authorization then evaluates access under policy.
Explains the accountable origin, purpose and bounded delegation behind a permitted action.
02 / Same operating case
Which request must be stopped?
A known agent uses a valid token to invoke a refund API on behalf of a support user.
Evaluation exercise
Hold a valid token and an allowed refund operation constant, then change the originating order and approver. The authority record should explain why only one refund is in scope.
03 / Architecture fit
How the controls can compose
Treat the three questions as successive facts in one decision, not interchangeable labels.
Authority is used here as the source and scope of permission; implementations can encode it in different systems.
04 / Evidence
Prove the decision and the effect separately.
Keep authenticated subject, policy decision, originating grant and final refund result separately.
Primary sources