the former separates the "what" a user can do from "which" object they can do it on