Week 11: Identity Is a Chain of Decisions

A username is not authorization. A successful login is not permission to perform every action. A session token is not the human. This week separates identification, authentication, authorization, session state, privilege, and account lifecycle so students can reason about identity systems without collapsing them into “password security.”

This week

1. Authentication Answers a Different Question Than Authorization — trace identity proof to an action decision.
2. Sessions Carry Authority After Login — model tokens, expiration, revocation, and evidence without handling real secrets.
3. Least Privilege Is an Ongoing Lifecycle — design role boundaries, join/move/leave changes, privileged review, and negative retests.

Evidence artifact

Create an Identity and Authorization Evidence Map with identities, roles, sensitive actions, authorization decisions, session lifecycle, role-change evidence, negative tests, and residual risk.