After authentication is done authorization is done by the IAM policies defined at compartment level and tenancy level.