"Who are you?" is a completely different question from "what can you do?" — and mixing them up is one of the most common access-control mistakes in software.
The two terms get used almost interchangeably in casual conversation — "auth" covers both, most login forms handle both in the same flow, and plenty of API middleware even bundles both into one function called checkAuth(). That convenience hides a real distinction: authentication and authorization are two separate decisions, answering two separate questions, and a system that quietly collapses them into one is exactly the kind of system where broken access control shows up.