Arrange the access-control steps in the order described in the lesson.

### Why this is right The request begins the process. The system then authenticates the requester, applies the permissions associated with the verified identity, and allows only the actions those permissions permit. ### The concept Access control supports confidentiality by restricting access to authorized users and systems. A request alone does not prove who made it. **Authentication** checks the requester's identity; **authorization** determines what the established identity may do. The system must keep these ideas distinct: successful authentication does not imply unrestricted authorization. Applying permissions after identity verification lets the system enforce rules for particular records, systems, or actions. ### The order 1. **A user or system requests access**: The process starts when someone seeks a resource or action. 2. **Check the identity of the requester**: The system must establish who is making the request before applying identity-specific rules. 3. **Apply the permissions associated with that identity**: The system determines which actions are allowed for that user or system. 4. **Allow only the requested actions that the permissions permit**: The outcome follows the permission check, not merely the fact that a request was made. ### Terms - **Authentication**: Checking the identity of a user or system. - **Authorization**: Determining the permitted actions or resources for an established identity. - **Access control**: The rules and mechanisms that limit use of information and systems. ### Remember A request is not permission: verify identity, check authority, then allow only permitted actions.