Authorization. What are you allowed to do?

See Authentication vs. authorization

#review