Taylor Swift recently threw a party at a club in New York City. Within 25 minutes, Taylor was being swarmed by people she didn’t know, the club exceeded capacity and the party was shut down by the police.

When her event planner investigated what had happened, the planner quickly zeroed in on a single security guard and demanded to know why he had let so many people into the party.

The security guard proudly replied, “I was completely diligent. I checked everyone’s ID, verified the results against government databases, and can guarantee that everyone was who they claimed to be.”

The event planner asked, “Did you check whether they were on the guest list?”

The security guard responded, “Why, no. No one ever gave me a list.”

That is the difference between authentication and authorization—and why you need both.