A system checks evidence such as a password, cryptographic key, token, certificate, or external identity-provider assertion. Successful verification establishes an identity for the current session or request. Authorization then determines what that identity may do.