Traditional risk management is concerned primarily with payment. On the Internet, risk may involve not only ability to pay but identity, age, privacy and many other considerations. By a model such as FAST, in which each party's financial institution acts as a trusted agent that verifies assertions such as identity or ability to pay made as part of a transaction. Authentication is the verification of attributes required to give parties unknown to each other the confidence to proceed with a transaction over the Internet. Enough to enable each party to a transaction to proceed with confidence.
Authentication is verification of identity or other attributes of parties to a transaction.
Authorization is approval, based on verified attributes, for the transaction to proceed. Yes, identity is the first of potentially multiple attributes that may need to be verified before all parties to a transaction will agree to proceed. On the Internet, they combine to provide that minimum level of information and confidence needed before parties to a transaction will proceed. In the FAST model, comprehensive authentication can be accomplished using the minimum necessary information about an individual in a rules-based framework that strictly defines the limits on how even that much information may be used. In the FAST model, the customer decides whether to divulge the attributes requested by a merchant or other entity.