A remote employee successfully logs into the corporate VPN using a valid username, password, and a token from their authenticator app. After connecting, they attempt to open a shared folder containing HR payroll files but receive an 'access denied' message, even though their credentials were accepted. Which pair of security concepts best explains what succeeded and what failed in this situation?