Why Authorization before Authentication?

[Edgar Fuß]

> - identify
> - authenticate
> - authorize
Ah, thanks! I understand the process much better now, replacing the section names (authorize, authenticate, post-auth) with what you gave (identify, authenticate, authorize).

> Put your authorization policies in [the post-auth] section.
OK, now it all makes sense.
But then I need to communicate things from authenticate to there. Where can I learn which Items I'm allowed/supposed to use for that?