Logging In Isn't Being Allowed — The auth-vs-auth Gap Newton Closes
Web2 learned this lesson decades ago.
Crypto somehow forgot it.
There are two words that look almost identical and mean very different things.
Authentication: proving who you are.
Authorization: deciding what you're allowed to do.
Logging in is authentication.
Being permitted to perform a specific action is authorization.
Every serious system treats these as separate layers.
Then I looked at how crypto handles it.
It collapsed both into a single signature.
If you hold the key, you're authenticated.
And being authenticated means you can do anything the contract allows.
There's no second layer asking "should this specific action happen?"
The key is identity and permission at once.
That conflation is exactly the gap @NewtonProtocol targets.
A wallet authenticates you.
Newton adds the missing authorization step.
Before a transaction settles, it's checked against a policy — not "who are you" but "should this be allowed."
Two layers again, like Web2 always had.
It's telling that this comes from Magic Labs.
A company that spent years on the authentication side — embedded wallets, tens of millions of logins.
They hit the wall from the inside.
Getting users in was solved.
Governing what they could do was not.
My honest caveat.
Adding a layer adds a dependency and a step.
And authorization is only as good as the policy behind it.
But the conceptual fix is correct.
A signature should prove who you are.
It was never supposed to mean "yes to everything."
$NEWT
#Newt
Web2 learned this lesson decades ago.
Crypto somehow forgot it.
There are two words that look almost identical and mean very different things.
Authentication: proving who you are.
Authorization: deciding what you're allowed to do.
Logging in is authentication.
Being permitted to perform a specific action is authorization.
Every serious system treats these as separate layers.
Then I looked at how crypto handles it.
It collapsed both into a single signature.
If you hold the key, you're authenticated.
And being authenticated means you can do anything the contract allows.
There's no second layer asking "should this specific action happen?"
The key is identity and permission at once.
That conflation is exactly the gap @NewtonProtocol targets.
A wallet authenticates you.
Newton adds the missing authorization step.
Before a transaction settles, it's checked against a policy — not "who are you" but "should this be allowed."
Two layers again, like Web2 always had.
It's telling that this comes from Magic Labs.
A company that spent years on the authentication side — embedded wallets, tens of millions of logins.
They hit the wall from the inside.
Getting users in was solved.
Governing what they could do was not.
My honest caveat.
Adding a layer adds a dependency and a step.
And authorization is only as good as the policy behind it.
But the conceptual fix is correct.
A signature should prove who you are.
It was never supposed to mean "yes to everything."
$NEWT
#Newt