Users proving who they are, normally using user id and password.
Ensuring that a user is permitted to perform an action.