Authorisation
What the proven identity is allowed to do. Authn is who. Authz is how far.
Authorisation is the decision after authentication: this identity may read that share, run that admin tool, or sit in that room. Access control and IAM are the machinery. Need-to-know is the attitude.
ASD language also uses 'authorising officer' for the executive who accepts residual risk and lets a system operate. Different job, same word family. Do not confuse a login with a go-live signature.
Standing allow-all after a successful password is how you turn one phished mailbox into a tenant.
Fact source: ASD's ACSC glossary.