Incorrect. The correct order is authentication first (proving identity), then authorization (granting access).