Authorization
BackendDeciding whether someone may do a thing.
Checking permission for a specific action on a specific record. Must be checked on the server, per request, per record. Being logged in is not permission to view record 41 just because you asked for it.
See also Authentication, IDOR