Login is the beginning of the decision
Modern identity systems are good at proving who is signing in and applying organisation authentication requirements. But a content platform has information the identity provider does not: the resource being requested, the action being attempted, the current share or retention state, and the organisation policy around that object.
That is why Casewelt treats authorisation as a product decision made after authentication, not as a synonym for authentication.
One person can have two different answers
Consider a People director who legitimately needs to open compensation data. The role may clearly allow reading the file. That does not mean the same person should be able to create an external share from it. A useful policy model can return allow for the first action and deny for the second without changing the person’s identity.
This is the practical shape of least privilege: preserve the work someone needs while constraining the actions that carry higher risk.
Session state matters too
Even an allowed action should stop when the session is no longer trusted. Revocation gives the product a way to end active access without pretending the user’s password has ceased to exist.
Separating identity, session and authorisation produces clearer failures and clearer audit. A revoked session, a policy denial and a validation error are different events and should remain distinguishable.
A simple evaluation
The simplest evaluation is to sign in once and try two different actions against the same file. If one is allowed and the other is denied for a clear policy reason, authentication and authorisation are doing different jobs.