This object reports which authorization method was used to determine this session's permitted access rights after authentication succeeded but before the session was established, distinct from crasAuthenMethod which covers identity verification. It matters because authentication, who you are, and authorization, what you are allowed to do, can use entirely different backends; an admin auditing a session's actual permitted access scope needs to know specifically which authorization method determined those rights. A session reporting an unexpected authorization method could explain why that session's permissions do not match what the admin assumed based on the group name alone.