What is identity, anyway?
Digital ID World has a blog called "Editor's Corner" - and in a recent edition, they talk about "Network Access Control", and how it's "all about Identity".
It is, and it isn't, about Identity. To say it's "all about identity" misrepresents NAC.
Network Access Control / Protection / Quarantine / Segregation or whatever you want to call it, is about verifying that machines meet your standards ("policies") before you allow them to connect to your network.
Your individual "standard" decides whether this Authorisation task includes an Identity requirement. If I say "all computers on my network have to have a valid user logged on", then it's an ID requirement. If I say "all computers must submit to a vulnerability scan and pass", then there's no identity involved.
Identity ("ID", not "ID10T"), Authentication ("AuthN"), and Authorisation (for some strange reason, this gets abbreviated to "AuthZ") are so closely interwoven that it's tempting to view them all as the same thing. But they are not.
Identity is a claim. ["I am Alun Jones"]
Authentication is proof of a claim of identity ["I sign my name the same way as you have it on record for Alun Jones", "I know the password that has been previously associated with Alun Jones"], or of group membership ["I am English", "I have brown hair", "I am an MVP"]. Authentication does not always require identity, although it is frequently implemented that way.
[Some people combine Identification with Authentication into the term "Authentification". I think that's a bad idea.]
Authorisation is a provision of access to resources ["I approve this request to handle the crown jewels", "Open up the vault"], and can be based on identity ["This guy says he's Alun Jones, so show him the developer pages, but not the administrator pages"], authentication ["We know this guy is Alun Jones, so let him access his bank information"], or other standards ["I don't know who you are, and I don't care who you claim to be, you're the tenth person through the gate, so you don't get to board the plane without a search"]. As you can see from my examples, authorisation doesn't always require identity or authentication, but in most cases, it does.
The differences between these concepts are subtle enough that it can be difficult to tell when you've blurred the lines. As Steve Riley points out, it is hugely important to realise the differences, and to keep them separated.