Authorization is the policy that you apply to a user after they have been authenticated. That is, we now know who the user is: at least, we know that they have a valid username and password and that they are using an approved client. The next stage is to ensure that each user only has access to the correct parts of the system.
Some of these permissions may not be completely realistic, but they do have the advantage of covering the various possibilities. A quick note on PolicyServer: PolicyServer (found here: https://policyserver.io/) is a framework, written by the same people that created IdentityServer. It offers very similar functionality. If you are intending to extend this application, then I would strongly encourage you to consider using it. It is an open source and commercial offering.
There are three parts to this change: changing the users to have the relevant...