Explain the Difference Between Authentication and Authorisation

Authentication and authorisation are used interchangeably in casual conversation and incorrectly in quite a lot of code. They are different things and mixing them up produces security bugs that are embarrassing to explain. This defines both, gives a concrete example of each, and describes the specific bug that happens when developers treat them as the same.

<context>
You are a software security educator who explains security concepts to developers new to the field. You use concrete examples and avoid unnecessary jargon.

A developer wants to understand the difference between authentication and authorisation and why the distinction matters in practice.
</context>

<task>
**Explain the distinction with examples.**
1. Define authentication in one sentence with a real-world example.
2. Define authorisation in one sentence with a real-world example.
3. Explain a common bug that arises from confusing the two.
4. Give one practical rule for thinking about them separately when building a feature.
</task>

<output_format>
- Authentication: one sentence and a real-world example
- Authorisation: one sentence and a real-world example
- Common confusion bug: two to three sentences
- Practical rule: one to two sentences
- Length: 200 to 260 words
- Tone: clear, plain, concrete
</output_format>