Authentication is proving who you are, for example by logging in with a password. Authorization is deciding what you are allowed to do once you are known, for example whether you can view a given record. They are separate steps: a request can be authenticated but still not authorized, and confusing the two is a common source of access bugs.
Why the distinction matters
Many apps get authentication right, a real login, and then assume that a logged-in user is allowed to do anything. That skips authorization. The result is that any signed-in user can often read or change another user's data just by changing an id in the request, because nothing checks ownership.
Where each belongs
Authentication happens once, at the edge, establishing identity. Authorization happens on every action, close to the data, answering does this specific user have permission for this specific thing. Both must run on the server; a check that only exists in the UI is not a check at all.
What this means for AI-generated code
AI tools reliably generate the login (authentication) because it is a visible feature, but routinely omit the per-request ownership check (authorization) because the feature works without it. That is why missing authorization is one of the most common high-severity issues we find in AI-built apps.