Identity tells you who is acting. Access tells you what systems that actor can reach. Authority determines what it may actually do, on whose behalf, for what purpose, under what constraints, right now.
A credential can let an agent call a system. It does not, by itself, authorize every action that system can perform.
Nexus decides that before the action executes. If Nexus says no, the action does not happen.
