Which statement correctly separates authentication from authorization?

Authentication proves who the caller is. Authorization then decides if that identity may do a specific action on a specific resource. The tempting mistake is "They are the same check, done once at login". That is wrong, because the server must check authorization on every request. Being logged in does not mean a user may do everything.