Authentication answers “Who are you?” Permissions answer “What are you allowed to do?” Proving identity gets you in the door; it doesn’t pick which doors open. It might be a password, Face ID, or an API key proving one system to another. With AI, the thing logging in is sometimes an agent, which is why OAuth and agent identity matters.
A hotel front desk works the same way. They don’t hand you a room key because you know the room number. They check your ID and the reservation first. Once they believe you’re the right person, you get a key to your room, and only your room.
Why you care
This is where AI work quietly becomes unsafe: the wrong credential and the agent fails, too much credential and it does too much, credentials stored badly and you have a security problem no smart model can fix. A secret is what a system uses to believe you; anyone who holds it can walk up to the front desk as you. Know who or what is logging in, keep credentials out of plain sight, and match identity to the job.