Authorisation checks which actions a user or application may perform. In Joomla, it determines whether someone can view restricted content, create records, edit another person's articles or change settings.
Authorisation and sign-in
Authentication establishes identity. Authorisation checks permissions. Signing in does not grant every operation, and each protected action needs a check for the relevant object.
Permissions in Joomla
Joomla ACL access levels control visibility, while permissions control actions. User groups, inheritance and component settings affect the effective result. Hiding a button is insufficient: the server must enforce permissions even for a direct request.
For example, an editor may change their own articles without being allowed to alter site configuration. A Joomla integration should also receive only the permissions it needs. Test both permitted operations and rejection for users lacking the required rights.
Conclusion
Authorisation limits actions after identity is established. Least privilege and server-side checks help maintain access boundaries.