The three questions

Every secured request must answer three questions in order:

1. Authentication: who are you? Establish identity from a credential (session token, API key).
2. Authorization: what may you touch? Given the identity, decide whether this specific action on this specific resource is allowed.
3. Isolation: can tenants reach each other's data? Ensure that, by construction, one user's data can't leak to another.

Treat these as distinct. Many breaches come from conflating them: authenticating a user and then assuming they're authorized for whatever they asked for.