The process of verifying that a user, device, or system is who or what it claims to be.
Authentication answers 'who are you?' — through passwords, biometrics, tokens, or certificates. It's distinct from authorization, which answers 'what are you allowed to do?' Confusing the two is a common source of security gaps.
