I heard fingerprints described as "Authentication, not authorisation", which I think is a better description of the role they play (on the iPhone, at least), and the role they should play.

They authenticate who you are, they aren't trivial to fake. However, they shouldn't authorise access to a device on their own. Your fingerprint works as a somewhat more secure, medium term swipe-to-unlock for your phone.

> I heard fingerprints described as "Authentication, not authorisation",

I understand once you've authenticated who the user is, authorization is just a mask of what they are allowed to do. It is like saying "after you've given your username (GMail account) to Google, it should allow you to read your email. If you happen to be an administrator for Google Business account you can also see other accounts or settings etc".

So hopefully you meant that you just use your fingerprint in place of typing out your username not in place of typing your username _and_ password.

One could see fingerprint and user/pw as two different roles - with different levels of authorisation.

(Somehow similar to sudo which asks for the user's password the first time but assumes that the logged in user is allowed to execute further sudo commands without pw auth. Even if sudo does not really implement two different user roles here.)

Authorization typically means what actions the authenticated user is allowed to perform, not that the authenticated user has herself conveyed some kind of approval.

Careful, authentication / authorization have specific definitions in software development which are at odds with what you say. A username/password together would be authentication.