What is the difference between MCP authentication and MCP authorization?

MCP authentication answers "who is making the request?" MCP authorization answers "what is that requester allowed to do?" Both are needed for production MCP use. An agent may authenticate successfully but still should not be allowed to call every tool or access every data source. Authorization should consider the agent identity, the tool, the operation, the data boundary, and the policy approved by the organization. Diagrid's content direction emphasizes MCP security because enterprises need identity, permission control, and auditability around agent-to-tool access, not just connector availability or a working MCP server.