What's the difference between a Spring Security 'role' and an 'authority'?

An authority is the raw granted permission string (e.g. `ROLE_ADMIN`, `SCOPE_read`), while a 'role' is really just a naming convention — Spring Security's role-based helpers (`hasRole("ADMIN")`) automatically prepend `ROLE_` when checking against authorities. Understanding this prevents a common bug: calling `hasRole("ROLE_ADMIN")` accidentally checks for `ROLE_ROLE_ADMIN` and always fails.