What it means
Authentication and authorization
Authentication establishes an identity or credential claim; authorization determines what that identity is allowed to do. A successful login does not mean that every operation should be permitted.
Apply permissions to real actions
In a payment system, viewing invoices, issuing refunds, changing payout destinations and signing transfers can require different permissions. Enforce the relevant rules on the trusted service side and review permissions when responsibilities change. Shared credentials and broad administrative access can obscure who actually authorized an action.
Related concepts
Key management, Multi-signature wallet, Application programming interface.
In practice
A concrete example
A support user can view payment status while a separate authorized role approves refunds and changes to payout settings.
Technical notes & boundaries
A hidden button is not an authorization boundary. Key possession, application roles and blockchain account permissions can represent different layers of control.
Go to the source.
Original references used for this definition. Product details and standards can change.
