Authentication
Prove who is knocking. Users, services, and devices all count. A username is a claim, not a proof.
Authentication is checking that a user, a process, or a device is who it says it is, before you hand it anything. Passwords, passkeys, certificates, and biometrics are proofs. The account name is just a label.
Interactive authentication is a person at a prompt. Non-interactive is machine-to-machine: service accounts, APIs, scheduled jobs. Those still need secrets you rotate and logs you read.
Get this wrong and authorisation is a costume. MFA, unique identities, and a join-move-leave process are how you stop guessing from becoming access.
Fact source: ASD's ACSC glossary.