authentication versus authorization, when do you use which

hey everyone, im working on a new microservice architecture and im trying to nail down the best way to handle security. we've got multiple services that need to know who a user is (authentication) and what theyre allowed to do (authorization). im thinking of a separate auth service. whats your go-to patterns for separating these concerns? do you keep them tightly coupled or completely separate? looking forward to hearing your experiences!