Definition
Authorization is the policy layer that runs after authentication has succeeded. Once a VPN provider knows who you are, it must decide what your account is entitled to. Free-tier accounts may be authorized to use only a handful of servers, premium accounts get the full server list, and enterprise accounts may be partitioned by department or device posture. Authorization rules can be coarse (a flag on the account) or fine-grained (per-application or per-resource).
How It Differs from Authentication
A useful way to remember the distinction: authentication is the bouncer checking your ID at the door, authorization is the wristband that determines which rooms inside the venue you can enter. Both are required, but they answer different questions and are often handled by separate subsystems.
In Enterprise VPNs
Corporate VPN gateways frequently integrate authorization with directory services (Active Directory, LDAP) so that group membership in the directory translates directly into VPN access policy. A user in the 'Finance' group, for example, may be authorized to reach the accounting servers but blocked from engineering resources. Modern Zero Trust frameworks push authorization down to every individual request rather than granting broad network access on the basis of a single login.