# Authorization Authorization determines what an authenticated identity may do: view data, administer an account, move assets, manage a domain, add users, or recover another service. ## Notebook evidence PDF pages 10–13 of [[Scanned_20260730-2016]] distinguish account identity from authority through AT&T/U-verse authorized-user and collections records. Page 41 extends the issue across Facebook, WhatsApp, ID.me, LinkedIn, Tumblr, Namecheap, and a Pixel device. Page 34–36 shows the extreme self-custody case, where possession of a valid wallet key may itself confer asset-control authority. ## Boundary An account name, saved password, recovery note, device label, or page-level association does not establish present authorization. Current authority requires contemporaneous provider, device, or cryptographic evidence. ## Source - [[Scanned_20260730-2016]], PDF pages 10–13, 34–36, and 41.