Module 12 · Security
Unit 44 of 49
Unit 44 · Module 12 · Security
Proving who you are and deciding what you may do are two different systems, and 401 is not 403.
Unit 44 of the free 49-unit computer-science course, in security. 3 topics to watch or read, 2 interview questions answered in full and a short self-check.
3 topics make up this unit. Take each one whichever way suits you, then answer the questions below.
Authentication and authorization sound the same and get mixed up constantly, but they answer two different questions: who are you, versus what are you allowed to do. Here's the difference that actually prevents security bugs — credentials and the three factors that build MFA, roles and scopes and policies checked on every request, the classic 401-vs-403 trap, and how the exact same split governs API keys and tool permissions for LLM agents.
RBAC attaches permissions to roles; ABAC evaluates policies over user, resource, action and environment attributes. RBAC scales with role explosion; ABAC with policy opacity. Real systems use both.
Asked out loud, answered out loud. Read the answer, then say it in your own words.
Authentication is who you are; authorization is what you may do. Authentication comes first and produces an identity; authorization takes that identity and a resource and returns a yes or no. A missing or invalid credential is 401 — try again with proof. A valid credential without permission is 403 — retrying will never help, and I should not hint at what would.
RBAC grants permissions to roles and roles to users: simple, auditable, and it explodes into "editor-but-only-in-region-two" roles the moment the rules involve the resource. ABAC evaluates a policy over attributes of the user, the resource and the context — expressive enough for "the owner, or a manager in the same department, during business hours", and much harder to reason about when someone asks who can see this record. Start with roles; add attributes where the roles start multiplying.
Answer alone, at 2am, with no interviewer in the room.
