How do authentication, authorization, and accounting differ?

Authentication establishes who or what is making a request. Authorization determines which actions that identity may perform on a particular resource. Accounting records relevant activity for monitoring and investigation. For example, signing in authenticates a user, checking whether they own an invoice authorizes access, and an audit event records the download. Authentication does not imply permission to every resource. Enforce authorization on the server for each relevant action, and protect audit records from unauthorized alteration while avoiding unnecessary storage of secrets or sensitive content.