Why is logging in not enough to authorize an agent or device to cause an effect?

Authentication answers who is requesting. Authority answers what that identity may cause, right now, on this resource. A stolen credential must not inherit unlimited powers.

Public educational material.

Evidence baseline

Hood's analysis distinguishes identity from current authorization. A governed action should establish the actor, the exact requested effect, the affected resource, the policy in force, and the evidence retained after execution.

NIST SP 800-207: Zero Trust Architecture
NIST Digital Identity Guidelines
CISA Secure by Design

These sources establish surrounding security context; Hood's effect-authority model is Hood's analysis. No endorsement or partnership is implied. Reviewed September 2, 2026.