Which security mechanism is responsible for verifying that users are indeed who the claim to be?