This mechanism improves security, auditability, and user experience by separating general authentication from action‑specific authorization.