Authentication and Authorization

Ana sends two requests to the booking service, and both are refused. In the first, she mistypes her password while booking seat A12, and the service answers 401 Unauthorized. In the second, she types the password correctly but tries to create an event with POST /events, and the service answers 403 Forbidden.

Why does the same customer get two different refusals? The first request failed because the service could not confirm who was calling. The second failed because the service knew exactly who was calling, and that person is not venue staff.