Authorize, Authenticate.. EAP

Hi! After read some of the guides for the EAP/(TLS/TTLS/PEAP) setup i was wondering why major of them indicate put "eap" on the authorize section of radiusd.conf Obiosuly, on the authenticate section "eap" must be set, but, on the authorize section? I have a working installation with EAP/TLS but the authorize sections just points to the mysql server (via the "sql" directive). What specifically do the eap module when its called from the authorize section? I'm asking this because i noted that always accpeted the user, and passed to the authenticate. I'm wrong? confused or simply missed something? The guides show us some "extra" steps that doesn't are necessary? Thks a lot!