{"id":5286,"date":"2026-03-12T14:17:55","date_gmt":"2026-03-12T14:17:55","guid":{"rendered":"https:\/\/discovery.cevolution.co.uk\/ciam\/?p=5286"},"modified":"2026-03-19T10:15:34","modified_gmt":"2026-03-19T10:15:34","slug":"auth-in-the-world-of-customer-identity","status":"publish","type":"post","link":"https:\/\/discovery.cevolution.co.uk\/ciam\/2026\/03\/12\/auth-in-the-world-of-customer-identity\/","title":{"rendered":"Auth In The World Of Customer Identity"},"content":{"rendered":"Reading Time: <\/span> 16<\/span> minutes<\/span><\/span>\n

In the world of Customer Identity and Access Management<\/span>, or CIAM for short, Authentication<\/strong> (a.k.a. AuthN) and Authorization<\/strong> (a.k.a AuthZ) are essentially the two sides of the “Auth” coin. The distinction between each is fundamental to achieving a successful outcome from both an integration and a security perspective. Yet it is often misunderstood.<\/p>\n\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n\n

At first glance, they appear similar, and there is certainly synergy between the two. Both relate to access, both are security controls, and both sit within the identity space. However, in reality, they solve two different problems: Authentication essentially answers the question of \u201cWho are you?\u201d<\/em> whilst, as a corollary, Authorization answers the question of \u201cWhat are you allowed to do?\u201d<\/em><\/p>\n\n\n\n

Authentication<\/th>Authorization<\/th><\/tr><\/thead>
Verifies identity<\/td>Grants approval<\/td><\/tr>
Executed infrequently<\/td>Evaluated repeatedly<\/td><\/tr>
Based on credentials<\/td>Based on policy<\/td><\/tr>
Token issuance<\/td>Permission validation<\/td><\/tr>
Identity-centric<\/td>Context-centric<\/td><\/tr><\/tbody><\/table>
Auth at a glance<\/em><\/figcaption><\/figure>\n\n\n\n

Governance \u2014 often referred to as Identity Governance and Administration, or IGA for short \u2014 also plays a large part. Governance essentially provides process layers that sit above<\/em> core Authentication and Authorization, particularly in Workforce IAM and B2B<\/span> CIAM scenarios. I’ll be covering this in more detail in a future article.<\/p>\n\n\n\n

\n

In workforce IAM, users are employees, control dominates, and trust boundaries are internal. With CIAM, users are customers, experience dominates, the trust boundary is the public internet and privacy regulations apply.<\/em><\/p>\n<\/div>\n\n\n\n

My name’s Peter Fernandez<\/span>, and in this article, I’m going to discuss the differences between Authentication and Authorization \u2014 exploring some of the concepts that help drive frictionless customer experiences at scale, whilst maintaining privacy and providing security that’s robust yet largely invisible.<\/p>\n\n\n\n

Authentication<\/h2>\n\n\n\n

Let’s start with Authentication \u2014 not least because it’s the precursor to anything that’s Auth-related. Authentication is the process of verifying a user\u2019s identity. In a CIAM context, this typically means \u201cyou are who you claim to be,\u201d and involves the likes of:<\/p>\n\n\n\n